CVE-2023-49574

A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /add_job in job_name. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.

Score

CVSS 3.1 7.1 High

Status

Analyzed - cve-coordination@incibe.es

Published

2024-05-24

Last modified

2024-08-02

Weaknesses

CWE-79

Affected products

• Vx Search (Flexense)
• Vx Search Enterprise (Flexense)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise