CVE-2023-26961: Improper Neutralization of Input During Web Page Generation

Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files. This vulnerability allows attackers to upload arbitrary files e.g., JavaScript content for stored XSS via the type field in a JSON document within a PUT /gallery/api/media request...

PT-2023-5024

Name of the Vulnerable Software and Affected Versions Alteryx Server version 2022.1.1.42590 Description The issue exists due to the lack of protection for the web page structure in Alteryx Server, allowing remote attackers to perform cross-site scripting XSS attacks via the type field using a PUT...

CVE-2023-26961

CVE-2023-26961 affects Alteryx Server 2022.1.1.42590, where uploaded files are not validated for type. This allows an attacker to upload arbitrary files (e.g., JavaScript content) through the type field in a JSON document sent to PUT /gallery/api/media, enabling stored XSS as described in the vul...