CVSS 3.1 Score 5.4 of 10 (medium)


Published Aug 2, 2023
Updated: Jan 12, 2024


CVE-2023-26445 is a vulnerability that affects multiple products, including 'afqUom', 'afqUol', 'afqUok', and others. It is categorized as CWE-79, which refers to the improper neutralization of input during web page generation (cross-site scripting). The vulnerability allows user-controllable jslob settings in frontend themes to point to malicious resources, which can be processed during login and execute malicious script code within the victim's context. This can lead to session hijacking or triggering unwanted actions through the web interface and API. To remediate this vulnerability, the theme value is now sanitized, and a default fallback is used if no theme matches. No publicly available exploits are known at this time. The severity of this vulnerability is rated as MEDIUM, with a base score of 5.4 out of 10, and it requires low privileges and user interaction to exploit it. The impact score is 2.7 out of 10, indicating a relatively low impact on confidentiality and integrity.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-26445 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options