Cross-Site Scripting Vulnerability in Forcepoint Web Security
CVE-2019-6146

6.1MEDIUM

Key Information:

Vendor

Forcepoint

Status
Forcepoint Web Security
Vendor
CVE Published:
22 January 2020

What is CVE-2019-6146?

A vulnerability exists in Forcepoint Web Security that allows for cross-site scripting (XSS) through host header injection. This flaw can enable an attacker to manipulate web responses, potentially leading to unauthorized data exposure or malicious actions performed on behalf of users. Affected users of Forcepoint Web Security version 8.x should review their configurations and potentially apply available security patches or implement additional security measures to mitigate the risk.

Affected Version(s)

Forcepoint Web Security 8.5, 8.4

References

http://packetstormsecurity.com/files/156274/Forcepoint-We...
x_refsource_MISC
https://help.forcepoint.com/security/CVE/CVE-2019-6146.html
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2019-6146 : Cross-Site Scripting Vulnerability in Forcepoint Web Security