PT-2024-14874 · Trellix · Trellix Central Management

Andrea Intilangelo · Published 2024-02-13 · Updated 2024-10-07 · CVE-2023-6072

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Trellix Central Management versions prior to 9.1.3.97129

Description A cross-site scripting issue allows a remote authenticated attacker to craft internal requests to the CM dashboard, causing arbitrary content to be injected into the response when accessing the dashboard.

Recommendations For versions prior to 9.1.3.97129, update to version 9.1.3.97129 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6072

Affected Products

Trellix Central Management

References · 7

• https://osv.dev/vulnerability/CVE-2023-6072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6072 · Security Note
• https://t.me/cvenotify/71214 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1757369073657065773 · Twitter Post
• https://docs.trellix.com/bundle/cm_9-1-5_rn/page/UUID-fad8a50f-6f6f-e970-f418-06494a30932e.html · Note
• https://twitter.com/CVEnew/status/1757342168161952163 · Twitter Post
• https://t.me/cvenotify/97236 · Telegram Post