CVE-2023-6366 HIGH

CVE-2023-6366: WhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert Center

Vendor Progress Software Corporation
Product WhatsUp Gold
Weakness CWE-79 · XSS
Published December 14, 2023
Last update May 21, 2025
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Alert Center.   If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.

Key dates

02Disclosure timeline

December 14, 2023 CVE published
May 21, 2025 Record updated