Unauthenticated XSS vulnerability in Norman's public API endpoint can lead to remote code execution

CVE-2023-32193

Summary

A cross-site scripting vulnerability exists in the public API endpoint of Norman, which allows unauthenticated users to inject malicious JavaScript code. When exploited, this vulnerability enables attackers to execute remote commands, potentially compromising user data and system integrity. This presents significant security risks for organizations utilizing the affected product, as an attacker could manipulate the behavior of web applications and access sensitive information without authorization.

References