CVE-2023-36288
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.
Risk Assessment
This vulnerability poses a risk of session hijacking, which could lead to unauthorized access to user accounts and data. Organizations should be aware of the potential consequences related to data security.
Recommendation
It is recommended to update Webkul QloApps to the latest version to mitigate this vulnerability. Additionally, implementing XSS protection mechanisms such as input validation and sanitization is advisable.
Original NVD description (English source)
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.