CVE-2023-23326
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A stored Cross-Site Scripting (XSS) vulnerability in AvantFAX 3.3.7 allows an authenticated low-privilege user to inject arbitrary JavaScript into their email address, which executes when an administrator views the admin dashboard.
Risk Assessment
An attacker can steal the administrator's session cookie and hijack their session, leading to unauthorized access to sensitive data and system functions.
Recommendation
Immediately update AvantFAX to the latest version and implement input validation and encoding for email addresses.
Other vulnerabilities in AvantFAX
See all- CVE-2023-23328High
An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file. This vulnerability affects AvantFAX version 3.3.7.
- CVE-2023-23327Medium
An information disclosure vulnerability exists in AvantFAX 3.3.7. Backups of sent/received faxes and database backups are stored with the current date as the filename and hosted on the web server without access controls.
Original NVD description (English source)
A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-mail address which is executed when an administrator logs into AvantFAX to view the admin dashboard. This may result in stealing an administrator's session cookie and hijacking their session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS