Description
Input passed to the "User-Agent" header parameter it isn't properly sanitised before being returned to the user on 404 or 500 error. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Confirmed in version MX 7. Other versions may also be affected.
Remediation
Contact the vendor for further information.
References
Related Vulnerabilities
Joomla! Core 3.x.x Multiple Cross-Site Request Forgery Vulnerabilities (3.2.0 - 3.9.15)
WordPress Plugin iThemes Security (formerly Better WP Security) Information Disclosure (5.1.1)
SharePoint CVE-2021-28453 Vulnerability (CVE-2021-28453)
MySQL CVE-2019-2743 Vulnerability (CVE-2019-2743)
WordPress Plugin WpPygments Multiple Cross-Site Scripting Vulnerabilities (0.3.2)