An authenticated stored cross-site scripting vulnerability in Altium 365 enables attackers to execute arbitrary JavaScript in the browsers of other users, posing a significant risk to session security.

This is a stored cross-site scripting (CWE-79) vulnerability caused by insufficient server-side input sanitization. Authenticated users can inject malicious HTML and JavaScript payloads into profile text fields, which execute when other users view the compromised profile.

The vulnerability carries a CVSS score of 7.6, reflecting a high risk of unauthorized access and data compromise. Successful exploitation could lead to session token theft, enabling attackers to hijack user accounts, perform phishing, or redirect users to malicious domains, which could result in significant reputational and operational damage.

Immediate Action: Review the official Altium security advisories for the release of a security patch and apply it to all affected instances immediately.

Proactive Monitoring: Audit user profile activity and monitor web application logs for unusual script injection patterns or unexpected characters within user-generated text fields.

Compensating Controls: Implement a robust Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious input patterns targeting profile fields.

Public Exploit Available: Unknown

Given the potential for session hijacking and unauthorized account access, this vulnerability should be prioritized for remediation. Administrators must track the vendor's security bulletins closely and deploy the necessary updates as soon as they become available to ensure the integrity of the platform and the security of user accounts.