Dear Flatboard team,

We are writing to you from INCIBE, the Spanish National Cybersecurity Institute, about 2 vulnerabilities reported by an external researcher in one of your products.

We participate in the CVE Program as CNA Root (https://www.cve.org/ProgramOrganization/Structure), which allows us to assign and publish CVE codes.

Please note that this report is not an incident, i.e. no one is exploiting the vulnerability. INCIBE is in charge of managing the CVE report, documentation and publication, in coordination with the affected parties.

As established in our disclosure policy, we have established by default a deadline of 60 days for you to take some kind of action for the resolution of these vulnerabilities, so we will start working on its publication from 11 of February.

Since we cannot attach the vulnerabilities here, we ask you to write to us by mail at cve-coordination@incibe.es.

Thank you very much and best regards,

Hi, I just contacted you by email today.
Thank you for your feedback.

Thanks for letting the team know!

A new version of Flatboard is available, correcting the vulnerabilities described by INCIBE (Spanish National Cybersecurity Institute).
It is recommended to update your site to Flatboard 3.2.2.

Good morning!

We have just published the advisory associated with this case:
• multiple-stored-cross-site-scripting-xss-vulnerabilities-flatboard-pro

As you can see, we have included in the “solution” field that the vulnerability is fixed in the 3.2.2. version.
The CVE information on the MITRE website will be updated in the coming hours.

We would like to take this opportunity to thank you for your time and collaboration during the coordination process of this CVE.

Best regards,
INCIBE CNA Team