CVE-2023-49111CWE-79

Reflected Cross-Site-Scripting in Kiuwan SAST

Medium · published June 20, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
50.4
In the wild
Unconfirmed
What it is

For Kiuwan installations with SSO (single sign-on) enabled, an

unauthenticated reflected cross-site scripting attack can be performed

on the login page "login.html". This is possible due to the request parameter "message" values

being directly included in a JavaScript block in the response. This is

especially critical in business environments using AD SSO

authentication, e.g. via ADFS, where attackers could potentially steal

AD passwords.

This issue affects Kiuwan SAST: <master.1808.p685.q13371

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00646 · 50.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-06-20T12:34Z
EPSS history
Timeline
  • 20 JUN 12:34Z
    Reflected Cross-Site-Scripting in Kiuwan SAST
    cvelistv5