CVE-2023-26998
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability was found in NetScout nGeniusOne version 6.3.4. It allows a remote attacker to execute arbitrary code via the 'creator' parameter on the Alert Configuration page.
Risk Assessment
An attacker can exploit this flaw to inject malicious scripts, potentially leading to session hijacking, administrator account takeover, or further privilege escalation within the organization.
Recommendation
Immediately update NetScout nGeniusOne to the latest available version that fixes this vulnerability. Additionally, implement input validation and sanitization for the 'creator' parameter.
Other vulnerabilities in NetScout nGeniusOne
See all- CVE-2023-26999Critical
An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file.
- CVE-2023-27000Medium
A Cross-Site Scripting (XSS) vulnerability was found in NetScout nGeniusOne version 6.3.4. It allows a remote attacker to execute arbitrary code via the 'name' parameter on the Profile and Exclusion List pages.
Original NVD description (English source)
Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator parameter of the Alert Configuration page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS