PT-2025-1476 · Unknown · Selesta Visual Access Manager

Published 2025-01-13 · Updated 2025-01-14 · CVE-2023-42250

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The software that is vulnerable is Selesta Visual Access Manager, specifically versions less than 4.42.2. The vulnerability is a Cross Site Scripting (XSS) vulnerability that can be exploited via the /common/autocomplete.php file. This vulnerability has been assigned the CVE identifier CVE-2023-42250. There is a public reference to this vulnerability available at the provided URLs, which may indicate the existence of a public exploit. However, there is no information provided about whether this vulnerability has been actively exploited by attackers or the potential number of internet users that could be affected. The vulnerability can be exploited by sending malicious input to the /common/autocomplete.php file, potentially allowing an attacker to inject and execute arbitrary JavaScript code in a user's browser. #SelestaVisualAccessManager #CrossSiteScripting #XSS #CVE202342250 #Vulnerability #Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-42250

Affected Products

Selesta Visual Access Manager

References · 6

• https://osv.dev/vulnerability/CVE-2023-42250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42250 · Security Note
• https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md · Note
• https://t.me/cvedetector/15192 · Telegram Post
• https://twitter.com/CVEnew/status/1878928252271550727 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1878952399131263182 · Twitter Post