CVE-2023-49572CWE-79

XSS vulnerability in VX Search Enterprise

High · published May 24, 2024

CVSS v3.1
7.1
EPSS
0%
Percentile
16.0
In the wild
Unconfirmed
What it is

A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, and in Disk Pulse Enterprise 10.4.18 version, that could allow an attacker to execute persistent XSS through /setup_odbc in odbc_data_source, odbc_user and odbc_password parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00254 · 16.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-05-24T12:39Z
EPSS history
Timeline
  • 24 MAY 12:39Z
    XSS vulnerability in VX Search Enterprise
    cvelistv5