CVE-2023-41922: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Kiloview P1/P2 devices

Published Jul 2, 2024

Updated

A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability allows for Stored XSS attacks to occur. Multiple areas within the administration interface of the webserver lack adequate input validation, resulting in multiple instances of Stored XSS vulnerabilities.

Affected Software

4 affected components

All of the following

Kiloview P1 Firmware

Kiloview P1

All of the following

Kiloview P2 Firmware

Kiloview P2

Event History

Jul 2, 2024

CVE Published

via MITRE·07:42 AM

Data Sourced

via MITRE·07:42 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-41922?

CVE-2023-41922 is classified as a high severity vulnerability due to its potential for storing and executing malicious scripts.

How do I fix CVE-2023-41922?

To fix CVE-2023-41922, ensure proper input validation and output encoding in all web application forms to prevent stored XSS attacks.

What types of attacks are possible with CVE-2023-41922?

CVE-2023-41922 allows for stored cross-site scripting (XSS) attacks, enabling attackers to execute scripts on the affected webserver.

Which software versions are affected by CVE-2023-41922?

CVE-2023-41922 affects specific versions of Kiloview P1 and P2 firmware.

What should I do if I am running vulnerable software related to CVE-2023-41922?

If running vulnerable software related to CVE-2023-41922, promptly apply any available security patches or updates provided by Kiloview.