PT-2023-18908 · Avantfax · Avantfax

Harold Rodriguez · Published 2023-03-10 · Updated 2025-02-27 · CVE-2023-23326

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AvantFAX version 3.3.7

Description A Stored Cross-Site Scripting (XSS) issue exists, allowing an authenticated low-privilege user to inject arbitrary Javascript into their e-mail address. This code is executed when an administrator logs in to view the admin dashboard, potentially resulting in the theft of an administrator's session cookie and session hijacking.

Recommendations For AvantFAX version 3.3.7, consider restricting access to the admin dashboard until a fix is available, and avoid using the e-mail address field for any sensitive operations. As a temporary workaround, consider validating and sanitizing user-input data, especially in the e-mail address field, to prevent malicious Javascript injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-23326

Affected Products

Avantfax

References · 5

• 🔥 https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md · Exploit
• http://avantfax.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23326 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23326 · Security Note
• https://t.me/cvenotify/112681 · Telegram Post