How severe is CVE-2023-49111?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.5 out of 10.

What type of vulnerability is CVE-2023-49111?

This is classified as CWE-79, which is a common weakness in software security.

CVE-2023-49111 - MEDIUM Severity | CVSS 6.5

Vulnerability Description

For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a JavaScript block in the response. This is especially critical in business environments using AD SSO authentication, e.g. via ADFS, where attackers could potentially steal AD passwords. This issue affects Kiuwan SAST: <master.1808.p685.q13371

Related Vulnerabilities

CVE-2014-9701

MEDIUM

CVSS:6.5(Medium)

Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalink_page....

CWE-792014

CVE-2015-7916

MEDIUM

CVSS:6.5(Medium)

Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.

CWE-792015

CVE-2016-11085

MEDIUM

CVSS:6.5(Medium)

php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishand...

CWE-792016

CVE-2017-17062

MEDIUM

CVSS:6.5(Medium)

The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows remote authenticated users to save arbitr...

CWE-792017

CVE-2018-10854

MEDIUM

CVSS:6.5(Medium)

cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scriptin...

CWE-792018

CVE-2018-1253

MEDIUM

CVSS:6.5(Medium)

RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit ...

CWE-792018