SearchBlox versions 8.1.x and below contain multiple vulnerabilities.
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CVE-2015-0967
SearchBlox contains multiple cross-site scripting (XSS) vulnerabilities, including a reflected XSS in the default search box of http://<HOST_NAME>:8080/searchblox/plugin/index.html and a persistent XSS in the title field of the 'Create Featured Result' form, http://<HOST_NAME>:8080/searchblox/admin/main.jsp?menu1=res. Note that an attacker must be authenticated to leverage the persistent XSS.
A remote, unauthenticated attacker may be able to execute arbitrary script in the contexts of the end-user's browser session, the application, or an authenticated user. Sensitive information may be exposed to unauthenticated users.
Apply an update
Thanks to Ashish Kamble of Qualys for reporting this vulnerability.
This document was written by Joel Land.