CVE-2023-45992 - A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface

Back Back to CVE browser

CRITICAL

A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface

Published Oct 19, 2023

9.6

CRITICAL

CVSS 3.1

EPSS 0.59%

Description

A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certain admin activity, could allow the attacker to gain full admin privileges on the exploited system.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-352

CSRF

CWE-79

Cross-site Scripting (XSS)

References (4)

https://github.com/harry935/CVE-2023-45992
ExploitThird Party Advisory
https://server.cloudpath/
Broken Link
https://server.cloudpath/admin/enrollmentData/
Broken Link
https://support.ruckuswireless.com/security_bulletins/322
Vendor Advisory

Link	Providers	Tags
https://github.com/harry935/CVE-2023-45992		ExploitThird Party Advisory
https://server.cloudpath/		Broken Link
https://server.cloudpath/admin/enrollmentData/		Broken Link
https://support.ruckuswireless.com/security_bulletins/322		Vendor Advisory