CVE-2023-33731
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
The eScan management console by Microworld Technologies version 14.0.1400.2281 has a reflected Cross Site Scripting (XSS) vulnerability in the view dashboard detail feature. This allows a remote attacker to inject arbitrary code via the URL.
Risk Assessment
An attacker can exploit this vulnerability to perform XSS attacks, potentially leading to user data theft or session hijacking. This poses a significant threat to the application's security and the organization's data.
Recommendation
It is recommended to update the eScan management console to the latest version to mitigate this vulnerability. Additionally, implementing security measures against XSS attacks, such as input validation and sanitization, is advisable.
Other vulnerabilities in Microworld Technologies eScan management console 14.0.1400.2281
See all- CVE-2023-33730Critical
The 'GetUserCurrentPwd' function in Microworld Technologies eScan Management Console contains a privilege escalation vulnerability. This allows a remote attacker to retrieve the password of any user (admin or normal) in plain text format.
- CVE-2023-33732Medium
The New Policy form in the Microworld Technologies eScan management console has a Cross Site Scripting (XSS) vulnerability that allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval.
Original NVD description (English source)
Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the URL directly.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS