CVE-2023-4592 - Improper Neutralization of Input During Web Page Generation in WPN-XM Serverstack

Back Back to CVE browser

MEDIUM

Improper Neutralization of Input During Web Page Generation in WPN-XM Serverstack

Published Nov 3, 2023

6.1

MEDIUM

CVSS 3.1

EPSS 0.42%

Description

A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload through the /tools/webinterface/index.php parameter and retrieve the cookie session details of an authenticated user, resulting in a session hijacking.

Affected products

Vendor Wpn-XM Product Serverstack Default
unaffected
- Version
  0.8.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wpn-XM

Serverstack

unaffected

Version	Status	Constraints
0.8.6	affected	-

Remediation

Vendor solution

There is no reported solution at this time.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54445
Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wpn-xm-serverstack
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54445		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wpn-xm-serverstack		Third Party Advisory