Medium severity · published Aug 3, 2023
CVE-2023-30958
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed.
This defect was resolved with the release of Foundry Frontend 6.225.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Frontend · Zabbix
before 6.225.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-30958
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-30958
Vendor Advisory
https://palantir.safebase.us/?tcuUid=5764b094-d3c0-4380-90f2-234f36116c9b
More from Frontend
9.8
CVE-2022-43515
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it
8.8
CVE-2023-32725
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports
6.5
CVE-2025-49643
Frontend DoS vulnerability due to asymmetric resource consumption
6.1
CVE-2023-29457
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser
6.1
CVE-2023-29455
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser