Stored Cross-Site Scripting in VI Web Client by Vendor
CVE-2023-40705

5.4MEDIUM

Key Information:

Vendor

I-pro Co., Ltd.

Status
Vi Web Client
Vendor
CVE Published:
5 September 2023

What is CVE-2023-40705?

A stored cross-site scripting vulnerability exists in the Map setting page of the VI Web Client, allowing remote authenticated attackers to inject arbitrary scripts. Successful exploitation can lead to session hijacking or unauthorized actions performed by users, compromising sensitive information and the integrity of the application. Users are encouraged to update to version 7.9.6 or later to mitigate this risk.

Affected Version(s)

VI Web Client prior to 7.9.6

References

https://downloadvi.com/downloads/IPServer/v7.9/796232/v79...
https://jvn.jp/en/jp/JVN60140221/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.