CVE-2023-34835
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary JavaScript code via a vulnerable delete_file parameter.
Risk Assessment
An attacker could exploit this vulnerability to hijack user sessions or steal data, posing a significant security risk to the organization.
Recommendation
It is recommended to update the eScan Management console to the latest version to mitigate this vulnerability and implement additional protections against XSS attacks.
Other vulnerabilities in Microworld Technologies eScan Management console v.14.0.1400.2281
See all- CVE-2023-34838Medium
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Description parameter.
- CVE-2023-34837Medium
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a vulnerable parameter GrpPath.
- CVE-2023-34836Medium
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Dtltyp and ListName parameters.
Original NVD description (English source)
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary JavaScript code via a vulnerable delete_file parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS