CVE-2023-27000
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability was found in NetScout nGeniusOne version 6.3.4. It allows a remote attacker to execute arbitrary code via the 'name' parameter on the Profile and Exclusion List pages.
Risk Assessment
The risk involves potential session hijacking, data theft, or malware propagation within the organization. An attacker could exploit this vulnerability to escalate privileges and further compromise the IT infrastructure.
Recommendation
Immediately update NetScout nGeniusOne to the latest available version that fixes this vulnerability. Additionally, implement input filtering for the 'name' parameter and apply the principle of least privilege.
Original NVD description (English source)
Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the name parameter of the Profile and Exclusion List page(s).