Cross-Site Scripting in Genesys Workforce Management Product
CVE-2021-26787

6.1MEDIUM

Key Information:

Vendor

Genesys

Status
Workforce Management
Vendor
CVE Published:
15 December 2021

What is CVE-2021-26787?

A cross-site scripting vulnerability exists in Genesys Workforce Management version 8.5.214.20 that can be exploited when deleting records. Malicious inputs in the Time-off parameter allow attackers to execute arbitrary JavaScript code in the context of users’ browsers. This could lead to unauthorized data access or manipulation, potentially compromising the security and integrity of user sessions.

References

https://medium.com/@reliable_lait_mouse_975/cross-site-sc...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.