Description

Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary code

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-18T17:16:57.397Z",
  "pubdate": "2026-08-18T17:16:57.397Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the user documentation field of Beta Systems Software AG ANOW! Automate v.3.3.1.90. This security flaw enables a remote attacker to execute arbitrary code within the context of a victim user session. The vulnerability resides in the application's handling of user-supplied input submitted through the documentation component, which fails to adequately sanitize or encode malicious payloads before rendering them in the browser. Successful exploitation can lead to unauthorized execution of script code, session hijacking, credential theft, or the manipulation of application content visible to the authenticated user. The attack vector is remote, requiring network access to the target application and typically the interaction of a legitimate user to trigger the malicious payload. Given the nature of enterprise automation software, exploitation of this vulnerability poses significant risk to administrative workflows and overall system integrity.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Scripting (XSS) flaw, stemming from insufficient input validation and output encoding in the user documentation field of Beta Systems Software AG ANOW! Automate v.3.3.1.90. The vulnerable component fails to properly sanitize special characters, such as angle brackets and quotation marks, when processing data submitted to the documentation interface. Consequently, an attacker can inject malicious HTML or JavaScript payloads into the vulnerable input vector, which is subsequently stored by the application and later rendered to other users accessing the documentation pages.\nThe attack flow begins with the adversary crafting a malicious payload containing arbitrary JavaScript designed to execute within the Document Object Model (DOM) of the victim browser session. The attacker submits this payload via the user documentation field, where it is accepted and persisted within the application backend data store without adequate sanitization. When a remote user navigates to the affected documentation page, the application retrieves the stored record and injects the raw payload into the HTTP response delivered to the client browser.\nUpon receiving the response, the victim browser parses and executes the injected script within the security context of the application origin. Depending on the design of the payload, this can facilitate session token theft via document.cookie access, the performance of unauthorized actions on behalf of the user, or the exfiltration of sensitive data accessible within the DOM. Network exposure is present wherever the web interface of ANOW! Automate v.3.3.1.90 is accessible to potential attackers. Exploitation relies on the application's failure to implement robust context-aware output encoding mechanisms, allowing malicious script execution whenever untrusted input is reflected or rendered."
}