PT-2023-14300 · Gx · Xperiencentral

Name of the Vulnerable Software and Affected Versions: GX Software XperienCentral versions 10.36.0 and earlier Description: The issue allows unauthorized users to post data to the server by sending POST requests to the /web/mvc endpoint if they can bypass other security filters. Recommendations:...

PT-2023-14298 · Gx · Xperiencentral

Name of the Vulnerable Software and Affected Versions: GX Software XperienCentral versions 10.31.0 through 10.33.0 Description: The issue allows for cross-site request forgery CSRF due to the unique token being deducible from the names of all input fields. Recommendations: For GX Software...

CVE-2022-43712

POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965...

CVE-2022-43713

Interactive Forms IAF in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validation could be bypassed...

CVE-2022-43710

Interactive Forms IAF in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery CSRF because the unique token could be deduced using the names of all input fields...

CVE-2022-43711

Interactive Forms IAF in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks XSS because the CSP header uses eval in the script-src...

CVE-2022-43711

Interactive Forms IAF in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks XSS because the CSP header uses eval in the script-src...

CVE-2022-43712: Missing Authorization

POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965...

CVE-2022-43710: Cross-Site Request Forgery (CSRF)

Interactive Forms IAF in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery CSRF because the unique token could be deduced using the names of all input fields...

CVE-2022-43713

GX Software XperienCentral has an IAF validation bypass vulnerability (CVE-2022-43713) affecting versions 10.33.1 through 10.35.0, allowing invalid data input via Interactive Forms. The issue stems from bypassable form validation in IAF. Impact is mainly data integrity for inputs; CVSS indicates ...

CVE-2022-43710

CVE-2022-43710 affects GX Software XperienCentral, versions 10.31.0 through 10.33.0. The vulnerability is a cross-site request forgery (CSRF) where the unique token can be deduced from the names of all input fields. The impact is CSRF exploitation risk as described in multiple sources. No exploit...

CVE-2022-43712

GX Software XperienCentral 10.36.0 and earlier is affected by CVE-2022-22965 (Spring4Shell) via data binding in Spring MVC/WebFlux on Java 9+. An attacker able to reach a vulnerable WAR/deployed app could achieve remote code execution. Root cause: unsafe data binding in Spring Framework modules; ...

CVE-2022-43711

GX Software XperienCentral (versions 10.29.1–10.33.0) is affected by a cross-site scripting (XSS) vulnerability caused by the CSP header using eval() in the script-src directive. The issue is tied to Interactive Forms (IAF) functionality and can be triggered via user interaction with the affected...

CVE-2022-43713: Improper Input Validation

Interactive Forms IAF in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validation could be bypassed...

CVE-2022-43711: Improper Neutralization of Input During Web Page Generation

Interactive Forms IAF in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks XSS because the CSP header uses eval in the script-src...

GX Software XperienCentral 输入验证错误漏洞

GX Software XperienCentral is a CMS from GX Software. A security vulnerability exists in GX Software XperienCentral versions 10.33.1 through 10.35.0, which stems from an easy bypass of the validation of Interactive Forms IAF...