Cross-Site Scripting Vulnerability in Faronics Insight on Windows
CVE-2023-28347

9.6CRITICAL

Key Information:

Vendor

Faronics

Status
Insight
Vendor
CVE Published:
31 May 2023

What is CVE-2023-28347?

A serious Cross-Site Scripting (XSS) vulnerability has been identified in Faronics Insight 10.0.19045 for Windows. This flaw allows attackers to craft proof-of-concept scripts that mimic a Student Console, leading to unauthorized exploitation of XSS vulnerabilities within the Teacher Console. Exploiting this vulnerability grants an unauthenticated attacker the capability to execute remote code as NT AUTHORITY/SYSTEM on all connected Student Consoles and the Teacher Console without any user interaction, posing significant risks to the integrity and security of educational environments.

References

https://research.nccgroup.com/?research=Technical%20advis...
https://research.nccgroup.com/2023/05/30/technical-adviso...

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-28347 : Cross-Site Scripting Vulnerability in Faronics Insight on Windows