CVE-2023-45992
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A vulnerability in the web-based interface of RUCKUS Cloudpath version 5.12 build 5538 or earlier allows a remote, unauthenticated attacker to perform persistent XSS and CSRF attacks against the admin interface. Combined with specific admin activity, the attack can lead to full administrative privileges.
Risk Assessment
The risk involves potential full system compromise by an unauthenticated attacker, leading to loss of confidentiality, integrity, and availability of the managed infrastructure.
Recommendation
Immediately upgrade RUCKUS Cloudpath to a version later than 5.12 build 5538 and implement protections against XSS and CSRF, such as input validation and CSRF tokens.
Original NVD description (English source)
A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certain admin activity, could allow the attacker to gain full admin privileges on the exploited system.