Unblu Spark vulnerabilities

In the embedded co-browsing feature in Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2 (on-premises and cloud), an unauthenticated remote attacker in the visitor role can execute arbitrary JavaScript in the browser of an agent participating in the attacker's co-browsing session, via content rendered as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or Single Conversation Desk. Exploitation requires an agent to join a session with the attacker; mobile co-apping is not affected.

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments. An authenticated remote attacker can read and change configuration properties of entities they aren't authorized to access, including other users, accounts, and in Unblu Cloud other customers' accounts.

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based XSS attack. When deployed with a specific configuration, it runs in the same origin as the host application, allowing an attacker full access to its resources.