Medium severity · published Jul 2, 2024
CVE-2023-41922
A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability allows for Stored XSS attacks to occur. Multiple areas within the administration interface of the webserver lack adequate input validation, resulting in multiple instances of Stored XSS vulnerabilities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
P1 Firmware · Kiloview
All versions, or not specified · source: NVD
PF
P2 Firmware · Kiloview
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41922
Third Party Advisory
https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
More from P1 Firmware
9.8
CVE-2023-41919
Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access