PT-2023-14299 · Gx · Xperiencentral
CVE-2022-43711
·
Publicado
2023-07-26
·
Atualizado
2023-08-04
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
GX Software XperienCentral versions 10.29.1 through 10.33.0
Description
The issue allows for cross site scripting attacks (XSS) due to the Content Security Policy (CSP) header using eval() in the script-src, which is associated with Interactive Forms (IAF) in the software.
Recommendations
For GX Software XperienCentral versions 10.29.1 through 10.33.0, consider updating the CSP header to avoid using eval() in the script-src to prevent XSS attacks. As a temporary workaround, consider restricting access to Interactive Forms (IAF) until a patch is available.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Xperiencentral