CVE-2023-4592

Description

A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload through the /tools/webinterface/index.php parameter and retrieve the cookie session details of an authenticated user, resulting in a session hijacking.

PUBLISHED Reserved 2023-08-29 | Published 2023-11-03 | Updated 2024-09-05 | Assigner INCIBE

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Credits

Rafael Pedrero finder

References

www.incibe.es/...multiple-vulnerabilities-wpn-xm-serverstack

cve.org (CVE-2023-4592)

nvd.nist.gov (CVE-2023-4592)

Download JSON