Reflected Cross-Site Scripting Vulnerability in VI Web Client by VI
CVE-2023-39938

6.1MEDIUM

Key Information:

Vendor: I-pro Co., Ltd.
Status: Vi Web Client
Vendor: CVE Published:; 5 September 2023

🔔 Create I-pro Co., Ltd. Vulnerability Alert

What is CVE-2023-39938?

A reflected cross-site scripting vulnerability in the VI Web Client allows remote attackers to inject arbitrary scripts into web pages. This vulnerability could be exploited by an unauthenticated attacker, leading to potential data theft or manipulation of user interactions within the web application. Organizations using versions of VI Web Client earlier than 7.9.6 should prioritize updating their software to mitigate this security risk.

Affected Version(s)

VI Web Client prior to 7.9.6

References

https://downloadvi.com/downloads/IPServer/v7.9/796232/v79...

https://jvn.jp/en/jp/JVN60140221/

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 5, 2023
Vulnerability Reserved
Aug 25, 2023

CVE-2023-39938 Data

JSON