CVE-2023-35759
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
In Progress WhatsUp Gold before version 23.0.0 has an SNMP-related application endpoint that fails to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, known as XSS.
Risk Assessment
This vulnerability poses a risk to organizations as it may lead to session hijacking and data theft. An attacker could exploit this vulnerability to inject malicious code in the context of the victim's browser.
Recommendation
It is recommended to update WhatsUp Gold to version 23.0.0 or later to mitigate this vulnerability. Additionally, implementing protections against XSS attacks is advisable.
Original NVD description (English source)
In Progress WhatsUp Gold before 23.0.0, an SNMP-related application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS.