CVE-2023-6364: WhatsUp Gold Stored Cross-Site Scripting (XSS) via Dashboard
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a dashboard component.
If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6364?
CVE-2023-6364 is classified as a medium severity stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2023-6364?
To mitigate CVE-2023-6364, upgrade to WhatsUp Gold version 2023.1 or later.
What systems are affected by CVE-2023-6364?
CVE-2023-6364 affects all WhatsUp Gold versions prior to 2023.1.
Can attackers exploit CVE-2023-6364 remotely?
Yes, attackers can exploit CVE-2023-6364 remotely through maliciously crafted XSS payloads.
What is the impact of CVE-2023-6364 on users?
The impact of CVE-2023-6364 allows attackers to execute arbitrary scripts in the context of a victim user’s session.