Products
VX Search Enterprise
- 10.2.14
Source
cve-coordination@incibe.es
Tags
CVE-2023-49573 details
Published : May 24, 2024, 1:15 p.m.
Last Modified : May 24, 2024, 6:09 p.m.
Last Modified : May 24, 2024, 6:09 p.m.
Description
A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /add_command_action in action_value. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7.1 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
Base Score
7.1
Exploitability Score
Impact Score
Base Severity
HIGH
Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
References
| URL | Source |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise | cve-coordination@incibe.es |
This website uses the NVD API, but is not approved or certified by it.