Lucene search

ForcepointVULNRICHMENT:CVE-2023-5451

HistoryMar 04, 2024 - 3:54 p.m.

CVE-2023-5451

2024-03-0415:54:43

CWE-79

forcepoint

github.com

forcepoint

ngfw

security management center

smc downloads

cross-site scripting

vulnerability

reflected xss

next generation firewall

eca configuration

cve-2023-5451

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.9

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Forcepoint
NGFW Security Management Center Management Server has SMC Downloads
optional feature to offer standalone Management Client downloads and ECA
configuration downloads.

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS.

This issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.

CNA Affected

[
  {
    "vendor": "Forcepoint",
    "modules": [
      "SMC Downloads"
    ],
    "product": "Next Generation Firewall Security Management Center ",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "6.10.13",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.11.0",
        "lessThan": "7.1.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

support.forcepoint.com/s/article/000042395

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.9

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-5451