PT-2023-24250 · Verint · Verint Engagement Management

Published 2023-08-02 · Updated 2023-08-04 · CVE-2023-33257

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Verint Engagement Management version 15.3 Update 2023R2

Description The issue concerns HTML injection via the user data form in the live chat. This allows for potential malicious code injection.

Recommendations For Verint Engagement Management version 15.3 Update 2023R2, consider restricting access to the user data form in the live chat until a fix is available. As a temporary workaround, disabling the live chat functionality may help minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-33257

Affected Products

Verint Engagement Management

References · 4

• 🔥 https://writeup.recoil.nl/verint · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-33257 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33257 · Vendor Advisory
• https://t.me/cibsecurity/67593 · Telegram Post