Persistent XSS Vulnerability in VX Search Enterprise Could Allow Attacker to Store Malicious JavaScript Payloads

CVE-2023-49572

What is CVE-2023-49572?

A security vulnerability has been identified in VX Search Enterprise, specifically within the 10.2.14 version. The flaw occurs in the handling of parameters, including odbc_data_source, odbc_user, and odbc_password, within the /setup_odbc interface. This oversight could allow an attacker to execute persistent cross-site scripting (XSS) attacks, enabling the injection of malicious JavaScript code. Such payloads could be stored on the system and executed when users access the compromised page, leading to potential data theft or unauthorized actions.

References