CVE-2023-0746

The help page in GigaVUE-FM, when using GigaVUE-OS software version 5.0 202, does not require an authenticated user. An attacker could enforce a user into inserting malicious JavaScript code into the URI, that could lead to a Reflected Cross site Scripting.

Score

CVSS 3.1 6.3 Medium

Status

Modified - cve-coordination@incibe.es

Published

2023-03-10

Last modified

2025-02-27

Weaknesses

CWE-79

Affected products

• Gigavue-fm (Gigamon)
• Gigavue-os (Gigamon)

References

• https://www.incibe-cert.es/en/early-warning/ics-advisories/xss-vulnerability-gigavue-fm