CVE-2023-0746 - XSS Vulnerability in GigaVue-FM

Back Back to CVE browser

MEDIUM

XSS Vulnerability in GigaVue-FM

Published Mar 10, 2023

6.3

MEDIUM

CVSS 3.1

EPSS 0.35%

Description

The help page in GigaVUE-FM, when using GigaVUE-OS software version 5.0 202, does not require an authenticated user. An attacker could enforce a user into inserting malicious JavaScript code into the URI, that could lead to a Reflected Cross site Scripting.

Affected products

Vendor Gigamon Product GigaVUE-FM Default
n/a
- Version
  GigaVUE-OS 5.0 202 5.0 202
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Gigamon

GigaVUE-FM

n/a

Version	Status	Constraints
GigaVUE-OS 5.0 202 5.0 202	affected	-

Remediation

Vendor solution

It is recommended to update to the latest available version of GigaVUE-OS.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12764
Advisory
https://www.incibe-cert.es/en/early-warning/ics-advisories/xss-vulnerability-gigavue-fm
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12764		Advisory
https://www.incibe-cert.es/en/early-warning/ics-advisories/xss-vulnerability-gigavue-fm		Third Party Advisory