PT-2025-1475 · Unknown · Selesta Visual Access Manager

Published 2025-01-13 · Updated 2025-01-14 · CVE-2023-42249

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The software that is vulnerable is Selesta Visual Access Manager, specifically versions less than 4.42.2. The vulnerability is a Cross Site Scripting (XSS) vulnerability that can be exploited via vam/vam visits.php. This vulnerability has been assigned the CVE identifier CVE-2023-42249. There is a public reference to this vulnerability available, indicating that it has been disclosed and potentially has a public exploit. However, there is no information provided about whether this vulnerability has been actively exploited by attackers or how many Internet users could be affected. The vulnerability allows for Cross Site Scripting, which can be used to steal user data or take control of user sessions. More information about this vulnerability can be found at the provided URLs. #SelestaVisualAccessManager #CrossSiteScripting #XSS #CVE202342249 #Vulnerability #Security #Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-42249

Affected Products

Selesta Visual Access Manager

References · 7

• https://osv.dev/vulnerability/CVE-2023-42249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42249 · Security Note
• https://t.me/cvedetector/15191 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1878954959355478209 · Twitter Post
• https://twitter.com/CVEnew/status/1878928251453640935 · Twitter Post
• https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md · Note
• https://twitter.com/gothburz/status/1879171716665983140 · Twitter Post