Cross-site Scripting Vulnerability in Forcepoint Cloud Security Gateway and Web Security Products
CVE-2023-26290
6.1MEDIUM
What is CVE-2023-26290?
A Cross-site Scripting (XSS) vulnerability exists in Forcepoint's Cloud Security Gateway (CSG) and Web Security products. This issue arises from improper handling of user input during the web page generation, particularly in the login_reset_request.mhtml module. Attackers can exploit this flaw to execute scripts in the context of the affected user's session, potentially leading to unauthorized data access or manipulation. The vulnerability impacts various products in Forcepoint's offerings and is present in versions released before March 29, 2023. Users are advised to take immediate action to mitigate associated risks.
Affected Version(s)
Cloud Security Gateway (CSG) Web Cloud Security Gateway 0 < 03/29/2023
Web Security Hybrid 0 < 03/29/2023