CVE-2023-21523 Cross-site scripting in AtHoc
Stored XSS in BlackBerry AtHoc Management Console allows attackers to execute scripts in user sessions, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-21523?
CVE-2023-21523 is a medium-severity cross-site scripting vulnerability in BlackBerry AtHoc, published on 12 Sep 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account.
Weakness: CWE-79
Which versions are affected by CVE-2023-21523?
It affects 1 product.
Products include Blackberry Athoc.
How do I fix CVE-2023-21523?
No fix has been published for CVE-2023-21523 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-21523 being exploited?
There is no known exploitation of CVE-2023-21523 in the wild and no public exploit code.
Other vulnerabilities in BlackBerry AtHoc
- CVE-2023-21521 SQL injection in AtHoc
- CVE-2023-21522 Cross-site scripting in AtHoc
- CVE-2019-8997 An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567
- CVE-2023-21520 Information disclosure in AtHoc
- CVE-2025-12766 Information disclosure in BlackBerry® AtHoc® (OnPrem)
Sources
Also known as GHSA-68cw-6674-r526.