CVE-2026-113465: Possible DOM XSS in SNS Web Administration Portal
It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel.
To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Stormshield SNSto a version that resolves this vulnerability.Fixed in 5.0.10 - Upgrade
Upgrade
Stormshield SNSto a version that resolves this vulnerability.Fixed in 5.1.4 EA
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated administrators of the Stormshield SNS Web Administration Portal are the targets. Exploitation requires an attacker to lure an authenticated administrator into visiting a crafted URL.
What does an attacker need to exploit it?
The attacker needs to create a URL with a malicious script payload in a specific parameter and persuade an authenticated administrator to open it. No attacker privileges are indicated in the provided data.
What is the potential impact if exploitation succeeds?
The supplied severity vector indicates high confidentiality impact and no integrity or availability impact. The scope is marked changed, meaning the impact may extend beyond the vulnerable component's security authority.