CVE-2023-33335

MediumCVSS 6.1

Published: 05/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

40th percentile - higher than 40% of all known CVEs

Summary

CVE-2023-33335 describes a Cross Site Scripting (XSS) vulnerability in Sophos iView software, allowing arbitrary script execution in the grpname parameter. This software reached its end of life on December 31, 2020.

Risk Assessment

An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking. Organizations using this software are at significant security risk.

Recommendation

It is recommended to immediately cease using Sophos iView and migrate to a supported solution. A security audit should also be conducted to identify potential threats.

Original NVD description (English source)

Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be executed.