CVE-2021-36450

Verint Workforce Optimization (WFO) version 15.2.8.10048 is vulnerable to Cross-Site Scripting (XSS) via the NEWUINAV parameter in the control/my_notifications endpoint. An attacker can inject malicious JavaScript code that executes in the victim's browser.

The risk includes potential session hijacking, theft of sensitive data, or unauthorized actions performed in the context of an authenticated administrator or employee. This could compromise data confidentiality and integrity within the organization.

Immediately upgrade Verint WFO to the latest available version that includes a fix for this XSS vulnerability. Until patched, restrict access to the web interface and implement input validation.