GroupSession is a web-based HR management software used by some organizations. This vulnerability allows attackers to execute arbitrary scripts on users' web browsers when accessing crafted pages or URLs, potentially leading to unauthorized access to user data and system configuration.
You're affected if you use Stored cross-site scripting vulnerability exists. Specific version info not stated in the advisory. If you don't recognise this software, you're probably not affected.
To fix this vulnerability:
- Upgrade to the latest version of GroupSession (ver5.3.0+): https://groupsession.jp/info/info-news/security20251208
- Immediate mitigations:
- Restrict network access to your GroupSession instance (firewall it from the public internet)
- Audit admin account activity for suspicious access patterns
- Monitor for unauthorized token creation