CVE-2023-6072

A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to craft CM dashboard internal requests causing arbitrary content to be injected into the response when accessing the CM dashboard.

Score

CVSS 3.1 5.4 Medium

Status

Modified - trellixpsirt@trellix.com

Published

2024-02-13

Last modified

2025-04-24

Weaknesses

CWE-79

Affected products

• Central Management System (Trellix)
• Trellix Central Management Cm (Trellix)

References

• https://docs.trellix.com/bundle/cm_9-1-5_rn/page/UUID-fad8a50f-6f6f-e970-f418-06494a30932e.html