CVE-2023-23326
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A stored Cross-Site Scripting (XSS) vulnerability in AvantFAX 3.3.7 allows an authenticated low-privilege user to inject arbitrary JavaScript into their email address, which executes when an administrator views the admin dashboard.
Risk Assessment
An attacker can steal the administrator's session cookie and hijack their session, leading to unauthorized access to sensitive data and system functions.
Recommendation
Immediately update AvantFAX to the latest version and implement input validation and encoding for email addresses.
Original NVD description (English source)
A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-mail address which is executed when an administrator logs into AvantFAX to view the admin dashboard. This may result in stealing an administrator's session cookie and hijacking their session.