CVE-2021-40096: 
SquaredUp vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in SquaredUp for SCOM version 5.2.1.6654 and earlier versions. The vulnerability, identified as CVE-2021-40096, was found in the integration configuration component and allows remote attackers to inject arbitrary web script or HTML via modification of the authorisationUrl in some integration configurations. The vulnerability was disclosed and documented in December 2021 (NVD, SquaredUp Support).

The vulnerability is a stored XSS issue that specifically affects the creation of Azure Active Directory, Azure App Insights, and Azure Log Analytics providers in SquaredUp Dashboard Server. The vulnerability allows attackers to inject malicious content into the application through the authorisationUrl parameter in integration configurations (SquaredUp Support).

The vulnerability enables attackers to inject and execute arbitrary web script or HTML in the context of the application, potentially affecting users who access the compromised configurations. This could lead to unauthorized access to sensitive information or manipulation of the application's behavior (NVD).

The vulnerability has been fixed in SquaredUp Dashboard Server version 5.3.1. Users running affected versions (earlier than 5.3.1) of SCOM Edition, Azure Edition, or Community Edition should upgrade to version 5.3.1 or later to address this security issue (SquaredUp Support).

The vulnerability was responsibly disclosed by Kajetan Rostojek from ING Tech Poland, demonstrating effective collaboration between security researchers and software vendors (SquaredUp Support).