Improper Input Neutralization in Calendar Event Feature of Product by Vendor

CVE-2023-27294

What is CVE-2023-27294?

This vulnerability arises from improper neutralization of input during the web page generation process, which allows authenticated attackers with restricted account access to submit malicious JavaScript as part of calendar event descriptions. When other users browse to these events, the injected JavaScript can execute in their browsers. Such exploitation can lead to serious risks, including the theft of session tokens from users with higher permissions and unauthorized actions taken on users' behalf, potentially compromising user accounts and sensitive data.

References