CVE-2023-26998

MediumCVSS 5.4

Published: 09/01/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

39th percentile - higher than 39% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability was found in NetScout nGeniusOne version 6.3.4. It allows a remote attacker to execute arbitrary code via the 'creator' parameter on the Alert Configuration page.

Risk Assessment

An attacker can exploit this flaw to inject malicious scripts, potentially leading to session hijacking, administrator account takeover, or further privilege escalation within the organization.

Recommendation

Immediately update NetScout nGeniusOne to the latest available version that fixes this vulnerability. Additionally, implement input validation and sanitization for the 'creator' parameter.

Original NVD description (English source)

Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator parameter of the Alert Configuration page.