CVE-2023-7166

Summary

CVE-2023-7166 is a newly disclosed vulnerability affecting Novel-Plus up to version 4.2.0. This issue lies in the HTTP POST Request Handler's unknown part of the /user/updateUserInfo file. Manipulation of the nickName argument leads to a cross-site scripting (XSS) vulnerability, allowing attackers to inject malicious code. The exploit is publicly known, and remote attacks are possible. To mitigate this risk, it is crucial to install the patch with the identifier c62da9bb3a9b3603014d0edb436146512631100d. VDB-249201 has been assigned to this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.