Medium severity · published Mar 10, 2023
CVE-2023-23326
A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-mail address which is executed when an administrator logs into AvantFAX to view the admin dashboard. This may result in stealing an administrator's session cookie and hijacking their session.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
Avantfax · Avantfax
3.3.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23326
Exploit
https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md
More from Avantfax
9.9
CVE-2025-1782
Unsanitized input in language form field
8.8
CVE-2023-23328
A File Upload vulnerability exists in AvantFAX 3.3.7
8.8
CVE-2020-11766
sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticated Command Injection
6.1
CVE-2017-18024
AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1
4.9
CVE-2023-23327
An Information Disclosure vulnerability exists in AvantFAX 3.3.7