CVE-2023-4564 - Multiple vulnerabilities in Canopsis of Capensis

MEDIUM

Multiple vulnerabilities in Canopsis of Capensis

Published Oct 3, 2023

4.8

MEDIUM

CVSS 3.1

EPSS 0.48%

This vulnerability could allow an attacker to store a malicious JavaScript payload in the broadcast message parameter within the admin panel.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
23.04-alpha3	affected	-

Vendor solution

Canopsis version 23.10.0 includes fixes for the reported vulnerability, and was released on 31 October 2023.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://git.canopsis.net/canopsis/canopsis-community/-/blob/develop/community/sources/webcore/src/canopsis-next/src/config.js?ref_type=heads#L38
https://git.canopsis.net/canopsis/canopsis-community/-/blob/develop/community/sources/webcore/src/canopsis-next/src/helpers/html.js?ref_type=heads
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canopsis-capensis		Third Party Advisory