CVE-2023-49950 Cross-site scripting in n/a
Remote attackers can inject XSS payloads via log data, leading to sensitive data disclosure when viewed in custom Jinja templates.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-49950?
CVE-2023-49950 is a medium-severity cross-site scripting vulnerability in n/a, published on 3 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a cross-site scripting (XSS) payload and send it to any system or device that sends logs to the SIEM. If an alert is created, the payload will execute upon the alert data being viewed with that template, which can lead to sensitive data disclosure.
Weakness: CWE-79
Which versions are affected by CVE-2023-49950?
It affects 1 product.
Products include Logpoint Siem.
How do I fix CVE-2023-49950?
No fix has been published for CVE-2023-49950 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-49950 being exploited?
There is no known exploitation of CVE-2023-49950 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-m293-hr45-hwwr.