PT-2023-18908 · Avantfax · Avantfax

Harold Rodriguez · Publicado 2023-03-10 · Atualizado 2025-02-27 · CVE-2023-23326

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AvantFAX version 3.3.7

Description A Stored Cross-Site Scripting (XSS) issue exists, allowing an authenticated low-privilege user to inject arbitrary Javascript into their e-mail address. This code is executed when an administrator logs in to view the admin dashboard, potentially resulting in the theft of an administrator's session cookie and session hijacking.

Recommendations For AvantFAX version 3.3.7, consider restricting access to the admin dashboard until a fix is available, and avoid using the e-mail address field for any sensitive operations. As a temporary workaround, consider validating and sanitizing user-input data, especially in the e-mail address field, to prevent malicious Javascript injection.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-23326

Produtos afetados

Avantfax

Referências · 5

• 🔥 https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md · Exploit
• https://t.me/cvenotify/112681 · Publicação no Telegram
• http://avantfax.com · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-23326 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-23326 · Nota de Segurança