CVE-2023-49575 XSS vulnerability in VX Search Enterprise
Attackers can inject persistent JavaScript via SMTP settings in Flexense search and sync tools, leading to code execution when the page loads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-49575?
CVE-2023-49575 is a high-severity cross-site scripting vulnerability in Flexense Disk Pulse Enterprise, published on 24 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, in Sync Breeze Enterprise Server 10.4.18 version, and in Disk Pulse Enterprise 10.4.18 version, that could allow an attacker to execute persistent XSS through /setup_smtp in smtp_server, smtp_user, smtp_password and smtp_email_address parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.
Weakness: CWE-79
Which versions are affected by CVE-2023-49575?
It affects 1 product.
Products include Flexense Vx Search.
How do I fix CVE-2023-49575?
No fix has been published for CVE-2023-49575 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-49575 being exploited?
There is no known exploitation of CVE-2023-49575 in the wild and no public exploit code.