Cross Site Scripting Vulnerability in Sage X3 by Sage Group
CVE-2023-31868

5.4MEDIUM

Key Information:

Vendor

Sage

Status
X3
Vendor
CVE Published:
22 June 2023

What is CVE-2023-31868?

Sage X3 version 12.14.0.50-0 is susceptible to a Cross Site Scripting (XSS) vulnerability due to insufficient validation of user inputs in dynamically generated web application components. Malicious actors can inject HTML/JavaScript code into specific input fields, which is then stored and executed in the browser of the user accessing the compromised page. While one injection point may be exploited by authenticated users with common accounts to target Administrators, other identified injection points require admin-level access, thereby limiting the potential impact.

References

https://github.com/Digitemis/Advisory/blob/main/CVE-2023-...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.