Cross-site Scripting Vulnerability in Forcepoint Cloud Security Gateway and Web Security Portal
CVE-2023-26291

6.1MEDIUM

Key Information:

Vendor

Forcepoint

Status
Cloud Security Gateway (csg)
Web Security
Vendor
CVE Published:
29 March 2023

What is CVE-2023-26291?

The vulnerability involves improper neutralization of input during web page generation that can lead to reflected Cross-site Scripting (XSS) attacks. Attackers could exploit this vulnerability in the Forcepoint Cloud Security Gateway (CSG) and Web Security Portal, jeopardizing user sessions and executing arbitrary scripts in the context of the user's session. This affects versions released prior to March 29, 2023, thus users are advised to update to the latest versions to ensure protection.

Affected Version(s)

Cloud Security Gateway (CSG) Web Cloud Security Gateway 0 < 03/29/2023

Web Security Hybrid 0 < 03/29/2023

References

https://support.forcepoint.com/s/article/000041617

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pratik Kumar Singh (@4rch_54m431)
.
CVE-2023-26291 : Cross-site Scripting Vulnerability in Forcepoint Cloud Security Gateway and Web Security Portal