Lucene search

[email protected]CVE-2023-26290

HistoryMar 29, 2023 - 5:15 p.m.

CVE-2023-26290

2023-03-2917:15:07

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-26290

cross-site scripting

forcepoint

cloud security gateway

csg

web security

xss

vulnerability

nvd

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

27.1%

JSON

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_reset_request.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_reset_request.mhtml modules) allows Reflected XSS.This issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.

Affected configurations

NVD

Node

forcepointcloud_security_gatewayRange<2023-03-29

forcepointweb_securityRange<2023-03-29

CPENameOperatorVersion
forcepoint:cloud_security_gatewayforcepoint cloud security gatewaylt2023-03-29
forcepoint:web_securityforcepoint web securitylt2023-03-29

CPE	Name	Operator	Version
forcepoint:cloud_security_gateway	forcepoint cloud security gateway	lt	2023-03-29
forcepoint:web_security	forcepoint web security	lt	2023-03-29

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "login_reset_request.mhtml"
    ],
    "packageName": "Portal",
    "platforms": [
      "Web Cloud Security Gateway",
      "Email Security Cloud"
    ],
    "product": "Cloud Security Gateway (CSG)",
    "vendor": "Forcepoint",
    "versions": [
      {
        "lessThan": "03/29/2023",
        "status": "affected",
        "version": "0",
        "versionType": "date"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "modules": [
      "login_reset_request.mhtml"
    ],
    "packageName": "Portal",
    "platforms": [
      "Hybrid"
    ],
    "product": "Web Security",
    "vendor": "Forcepoint",
    "versions": [
      {
        "lessThan": "03/29/2023",
        "status": "affected",
        "version": "0",
        "versionType": "date"
      }
    ]
  }
]

References

support.forcepoint.com/s/article/000041617

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

27.1%

JSON

Related for CVE-2023-26290

cvelist1 nvd1 prion1