CVE-2023-41165: XSS
First published: Mon Dec 25 2023(Updated: )
An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 before 4.3.22, and 4.4.0 through 4.6.8 before 4.6.9. An administrator with write access to the SNS firewall can configure a login disclaimer with malicious JavaScript elements that can result in data theft.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Stormshield Network Security | >=3.7.0<3.7.38>=3.10.0<3.11.26>=4.0<4.3.21>=4.4.0<4.6.8 | |
| Stormshield Network Security (SNS) | >=3.7.0<3.7.39 | |
| Stormshield Network Security (SNS) | >=3.10.0<3.11.27 | |
| Stormshield Network Security (SNS) | >=4.0.0<4.3.22 | |
| Stormshield Network Security (SNS) | >=4.4.0<4.6.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-41165?
CVE-2023-41165 has a medium severity rating due to the potential for unauthorized access and configuration changes by administrators.
How do I fix CVE-2023-41165?
To fix CVE-2023-41165, administrators should upgrade the Stormshield Network Security (SNS) to version 3.7.39, 3.11.27, 4.3.22, or 4.6.9 or later.
Who is affected by CVE-2023-41165?
CVE-2023-41165 affects users of Stormshield Network Security (SNS) versions 3.7.0 to 3.7.38, 3.10.0 to 3.11.26, 4.0 to 4.3.21, and 4.4.0 to 4.6.8.
What types of attacks does CVE-2023-41165 allow?
CVE-2023-41165 could allow an attacker with write access to the SNS firewall to configure a login disclaimer, potentially misleading users.
Is CVE-2023-41165 a zero-day vulnerability?
No, CVE-2023-41165 is not classified as a zero-day vulnerability since a patch is available from the vendor.
- agent/type
- agent/first-publish-date
- agent/references
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- collector/nvd-api
- source/NVD
- vendor/stormshield
- canonical/stormshield network security
- canonical/stormshield network security (sns)
- version/stormshield network security (sns)/3.7.0
- version/stormshield network security (sns)/3.10.0
- version/stormshield network security (sns)/4.0.0
- version/stormshield network security (sns)/4.4.0