PT-2023-14299 · Gx · Xperiencentral

Published 2023-07-26 · Updated 2023-08-04 · CVE-2022-43711

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GX Software XperienCentral versions 10.29.1 through 10.33.0

Description The issue allows for cross site scripting attacks (XSS) due to the Content Security Policy (CSP) header using eval() in the script-src, which is associated with Interactive Forms (IAF) in the software.

Recommendations For GX Software XperienCentral versions 10.29.1 through 10.33.0, consider updating the CSP header to avoid using eval() in the script-src to prevent XSS attacks. As a temporary workaround, consider restricting access to Interactive Forms (IAF) until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-43711

Affected Products

Xperiencentral

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-43711 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43711 · Vendor Advisory
• https://service.gxsoftware.com/hc/nl/articles/12208173122461 · Vendor Advisory
• https://service.gxsoftware.com · Note