CVE-2023-25292: XSS

Published Apr 27, 2023

Updated

Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GOLANGUAGE cookie.

Affected Software

1 affected component

Group-Office Group Office=6.6.145

Event History

Apr 27, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-25292?

CVE-2023-25292 is a vulnerability known as Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145.

What is the severity of CVE-2023-25292?

The severity of CVE-2023-25292 is medium, with a severity value of 6.1.

How does CVE-2023-25292 affect Intermesh BV Group-Office?

CVE-2023-25292 allows attackers to gain escalated privileges and sensitive information via the GO_LANGUAGE cookie in Intermesh BV Group-Office version 6.6.145.

How can an attacker exploit CVE-2023-25292?

An attacker can exploit CVE-2023-25292 by injecting malicious scripts into the GO_LANGUAGE cookie and tricking users into executing them.

Is there a fix available for CVE-2023-25292?

Yes, updating Intermesh BV Group-Office to a version beyond 6.6.145 will fix CVE-2023-25292.