CVE-2023-26445

Summary

CVE-2023-26445 is a vulnerability that affects multiple products, including 'afqUom', 'afqUol', 'afqUok', and others. It is categorized as CWE-79, which refers to the improper neutralization of input during web page generation (cross-site scripting). The vulnerability allows user-controllable jslob settings in frontend themes to point to malicious resources, which can be processed during login and execute malicious script code within the victim's context. This can lead to session hijacking or triggering unwanted actions through the web interface and API. To remediate this vulnerability, the theme value is now sanitized, and a default fallback is used if no theme matches. No publicly available exploits are known at this time. The severity of this vulnerability is rated as MEDIUM, with a base score of 5.4 out of 10, and it requires low privileges and user interaction to exploit it. The impact score is 2.7 out of 10, indicating a relatively low impact on confidentiality and integrity.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.