PT-2023-2993 · Faronics · Faronics Insight

Published 2023-02-01 · Updated 2025-01-13 · CVE-2023-28350

Positive Technologies (AI Summary)

CVSS v2.0

8.0

High

Base vector

AV:A/AC:L/Au:N/C:P/I:C/A:C

Name of the Vulnerable Software and Affected Versions Faronics Insight versions 10.0.19045

Description The issue is related to the lack of protection of the web page structure in the Teacher Console and Student Console components of the Faronics Insight platform. This allows an attacker to perform cross-site scripting attacks by sending specially crafted HTTP requests. The vulnerability enables an attacker to execute JavaScript in the Teacher and Student Console applications, potentially leading to remote code execution on connected student machines and the teacher's machine.

Recommendations For Faronics Insight version 10.0.19045, consider disabling the execution of JavaScript in the Teacher and Student Console applications as a temporary workaround until a patch is available. Restrict access to the Teacher Console to minimize the risk of exploitation. Avoid using the Teacher Console on untrusted networks until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-03020

CVE-2023-28350

Affected Products

Faronics Insight

References · 5

• 🔥 https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight · Exploit
• https://bdu.fstec.ru/vul/2023-03020 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28350 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28350 · Vendor Advisory
• https://research.nccgroup.com/?research=Technical%20advisories · Note