GRR is a resource management and reservation application. Prior to version 4.5.0, "maj.php" reflects the "forcemaj" parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not "HttpOnly". This issue is fixed in version 4.5.0.