CVE-2023-49111

CVE-2023-49111: Reflected Cross-Site-Scripting in Kiuwan SAST

Vendor Kiuwan

Product SAST

Weakness CWE-79 · XSS

Published June 20, 2024

Last update November 4, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a JavaScript block in the response. This is especially critical in business environments using AD SSO authentication, e.g. via ADFS, where attackers could potentially steal AD passwords. This issue affects Kiuwan SAST: <master.1808.p685.q13371

Key dates

02Disclosure timeline

June 20, 2024 CVE published

November 4, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-49111 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-25716 WordPress Announce from the Dashboard Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS) CVE-2025-0864 Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.6 - Reflected Cross-Site Scripting CVE-2025-54055 WordPress Druco <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability CVE-2024-3681 Interactive World Maps <= 2.4.14 - Reflected Cross-Site Scripting CVE-2026-21361 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)