Lucene search

SymantecCVE-2023-23956

HistoryMay 30, 2023 - 8:15 p.m.

CVE-2023-23956

2023-05-3020:15:10

CWE-79

symantec

web.nvd.nist.gov

cve-2023-23956

nvd

security

malicious code

html

javascript

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

46.9%

JSON

A user can supply malicious HTML and JavaScript code that will be executed in the client browser

Affected configurations

Nvd

Node

broadcomsymantec_siteminder_webagentMatch12.52

VendorProductVersionCPE
broadcomsymantec_siteminder_webagent12.52cpe:2.3:a:broadcom:symantec_siteminder_webagent:12.52:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
broadcom	symantec_siteminder_webagent	12.52	cpe:2.3:a:broadcom:symantec_siteminder_webagent:12.52:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Symantec SiteMinder WebAgent",
    "versions": [
      {
        "version": "12.5.2",
        "status": "affected"
      }
    ]
  }
]

References

packetstormsecurity.com/files/173038/Symantec-SiteMinder-WebAgent-12.52-Cross-Site-Scripting.html

support.broadcom.com/external/content/SecurityAdvisories/0/22221