PT-2023-18834 · Zoho · Zoho Asset Explorer

CVE-2023-23075 · Publicado 2023-02-01 · Atualizado 2023-02-08

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoho Asset Explorer version 6.9

Description A Cross Site Scripting (XSS) issue exists in Zoho Asset Explorer via the credential name when creating a new Assets Workstation. This allows for potential malicious script execution.

Recommendations For Zoho Asset Explorer version 6.9, consider disabling the creation of new Assets Workstations until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the credential name field to minimize the risk of malicious script injection.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-23075

Produtos afetados

Zoho Asset Explorer

Referências · 5

• https://bugbounty.zohocorp.com/bb/#/bug/101000006463045?tab=originator · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-23075 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-23075 · Aviso do Fabricante
• https://t.me/cvenotify/43360 · Publicação no Telegram
• https://t.me/cibsecurity/57352 · Publicação no Telegram