CVE-2023-6367 HIGH

CVE-2023-6367: WhatsUp Gold Stored Cross-Site Scripting (XSS) via Roles

Vendor Progress Software Corporation
Product WhatsUp Gold
Weakness CWE-79 · XSS
Published December 14, 2023
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Roles.   If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.

Key dates

02Disclosure timeline

December 14, 2023 CVE published
August 2, 2024 Record updated