CVE-2023-23326: XSS

Published Mar 10, 2023

Updated

A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-mail address which is executed when an administrator logs into AvantFAX to view the admin dashboard. This may result in stealing an administrator's session cookie and hijacking their session.

Affected Software

1 affected component

AvantFAX AvantFAX=3.3.7

Event History

Mar 10, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-23326?

CVE-2023-23326 has a high severity rating due to its potential to allow an attacker to execute JavaScript in the context of an administrator's session.

How do I fix CVE-2023-23326?

To fix CVE-2023-23326, ensure that input validation and sanitization are properly implemented for user input in email fields.

Who is affected by CVE-2023-23326?

CVE-2023-23326 affects users of AvantFAX version 3.3.7 who have authenticated low privilege roles.

What type of vulnerability is CVE-2023-23326?

CVE-2023-23326 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.

What can be stolen due to CVE-2023-23326?

CVE-2023-23326 may allow an attacker to steal session cookies and sensitive data from the administrator when they log into the AvantFAX admin dashboard.