Vulnerability-Lookup

CVE-2023-6452 (GCVE-0-2023-6452)

Vulnerability from cvelistv5 – Published: 2024-08-22 15:21 – Updated: 2024-08-22 19:50

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS. The Forcepoint Web Security portal allows administrators to generate detailed reports on user requests made through the Web proxy. It has been determined that the "user agent" field in the Transaction Viewer is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, which can be exploited by any user who can route traffic through the Forcepoint Web proxy. This vulnerability enables unauthorized attackers to execute JavaScript within the browser context of a Forcepoint administrator, thereby allowing them to perform actions on the administrator's behalf. Such a breach could lead to unauthorized access or modifications, posing a significant security risk. This issue affects Web Security: before 8.5.6.

Severity ?

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

forcepoint

References

URL

Tags

https://support.forcepoint.com/s/article/000042212

Impacted products

	Vendor	Product	Version
	Forcepoint	Web Security	Affected: 0 , < 8.5.6 (semver)

Credits

Jasper Westerman Yanick de Pater Harm Blankers from REQON

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:forcepoint:web_security:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "web_security",
            "vendor": "forcepoint",
            "versions": [
              {
                "lessThan": "8.5.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-22T19:48:57.338566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-22T19:50:08.561Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "Transaction Viewer"
          ],
          "product": "Web Security",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "8.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The\n User Agent field must be displayed in the Transaction Viewer, it is not by default. Users \nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later."
            }
          ],
          "value": "The\n User Agent field must be displayed in the Transaction Viewer, it is not by default. Users \nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jasper Westerman"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Yanick de Pater"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Harm Blankers from REQON"
        }
      ],
      "datePublic": "2024-08-21T19:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\nThe\n Forcepoint Web Security portal allows administrators to generate \ndetailed reports on user requests made through the Web proxy. It has \nbeen determined that the \"user agent\" field in the Transaction Viewer is\n vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, \nwhich can be exploited by any user who can route traffic through the \nForcepoint Web proxy.\u003cbr\u003e\u003cbr\u003eThis \nvulnerability enables unauthorized attackers to execute JavaScript \nwithin the browser context of a Forcepoint administrator, thereby \nallowing them to perform actions on the administrator\u0027s behalf. Such a \nbreach could lead to unauthorized access or modifications, posing a \nsignificant security risk.\n\n\n\n\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThis issue affects Web Security: before 8.5.6.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.\n\n\n\n\n\nThe\n Forcepoint Web Security portal allows administrators to generate \ndetailed reports on user requests made through the Web proxy. It has \nbeen determined that the \"user agent\" field in the Transaction Viewer is\n vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, \nwhich can be exploited by any user who can route traffic through the \nForcepoint Web proxy.\n\nThis \nvulnerability enables unauthorized attackers to execute JavaScript \nwithin the browser context of a Forcepoint administrator, thereby \nallowing them to perform actions on the administrator\u0027s behalf. Such a \nbreach could lead to unauthorized access or modifications, posing a \nsignificant security risk.\n\n\n\n\n\n\nThis issue affects Web Security: before 8.5.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-22T15:21:32.329Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000042212"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCustomers should update to version 8.5.6 or follow the steps outlined in\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.forcepoint.com/s/article/000042212\"\u003ehttps://support.forcepoint.com/s/article/000042212\u003c/a\u003e\u0026nbsp;for version 8.5.5.\u003c/p\u003e"
            }
          ],
          "value": "Customers should update to version 8.5.6 or follow the steps outlined in\u00a0 https://support.forcepoint.com/s/article/000042212 \u00a0for version 8.5.5."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\nUsers \nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later.\n\n\n\n\u003c/p\u003e"
            }
          ],
          "value": "Users \nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2023-6452",
    "datePublished": "2024-08-22T15:21:32.329Z",
    "dateReserved": "2023-11-30T22:10:02.333Z",
    "dateUpdated": "2024-08-22T19:50:08.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-6452\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-22T19:48:57.338566Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:forcepoint:web_security:*:*:*:*:*:*:*:*\"], \"vendor\": \"forcepoint\", \"product\": \"web_security\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"8.5.6\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-22T19:50:02.197Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Jasper Westerman\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Yanick de Pater\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Harm Blankers from REQON\"}], \"impacts\": [{\"capecId\": \"CAPEC-592\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-592 Stored XSS\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Forcepoint\", \"modules\": [\"Transaction Viewer\"], \"product\": \"Web Security\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"8.5.6\", \"versionType\": \"semver\"}], \"defaultStatus\": \"affected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Customers should update to version 8.5.6 or follow the steps outlined in\\u00a0 https://support.forcepoint.com/s/article/000042212 \\u00a0for version 8.5.5.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eCustomers should update to version 8.5.6 or follow the steps outlined in\u0026nbsp;\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://support.forcepoint.com/s/article/000042212\\\"\u003ehttps://support.forcepoint.com/s/article/000042212\u003c/a\u003e\u0026nbsp;for version 8.5.5.\u003c/p\u003e\", \"base64\": false}]}], \"datePublic\": \"2024-08-21T19:00:00.000Z\", \"references\": [{\"url\": \"https://support.forcepoint.com/s/article/000042212\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Users \\nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\\nUsers \\nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later.\\n\\n\\n\\n\u003c/p\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.\\n\\n\\n\\n\\n\\nThe\\n Forcepoint Web Security portal allows administrators to generate \\ndetailed reports on user requests made through the Web proxy. It has \\nbeen determined that the \\\"user agent\\\" field in the Transaction Viewer is\\n vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, \\nwhich can be exploited by any user who can route traffic through the \\nForcepoint Web proxy.\\n\\nThis \\nvulnerability enables unauthorized attackers to execute JavaScript \\nwithin the browser context of a Forcepoint administrator, thereby \\nallowing them to perform actions on the administrator\u0027s behalf. Such a \\nbreach could lead to unauthorized access or modifications, posing a \\nsignificant security risk.\\n\\n\\n\\n\\n\\n\\nThis issue affects Web Security: before 8.5.6.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\\nThe\\n Forcepoint Web Security portal allows administrators to generate \\ndetailed reports on user requests made through the Web proxy. It has \\nbeen determined that the \\\"user agent\\\" field in the Transaction Viewer is\\n vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, \\nwhich can be exploited by any user who can route traffic through the \\nForcepoint Web proxy.\u003cbr\u003e\u003cbr\u003eThis \\nvulnerability enables unauthorized attackers to execute JavaScript \\nwithin the browser context of a Forcepoint administrator, thereby \\nallowing them to perform actions on the administrator\u0027s behalf. Such a \\nbreach could lead to unauthorized access or modifications, posing a \\nsignificant security risk.\\n\\n\\n\\n\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThis issue affects Web Security: before 8.5.6.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"The\\n User Agent field must be displayed in the Transaction Viewer, it is not by default. Users \\nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The\\n User Agent field must be displayed in the Transaction Viewer, it is not by default. Users \\nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later.\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"e23ea22c-8c39-4eff-8980-2881e5ae54e2\", \"shortName\": \"forcepoint\", \"dateUpdated\": \"2024-08-22T15:21:32.329Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-6452\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-22T19:50:08.561Z\", \"dateReserved\": \"2023-11-30T22:10:02.333Z\", \"assignerOrgId\": \"e23ea22c-8c39-4eff-8980-2881e5ae54e2\", \"datePublished\": \"2024-08-22T15:21:32.329Z\", \"assignerShortName\": \"forcepoint\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2023-6452

Vulnerability from fkie_nvd - Published: 2024-08-22 16:15 - Updated: 2024-08-23 16:18

Severity ?

9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@forcepoint.com	https://support.forcepoint.com/s/article/000042212

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.\n\n\n\n\n\nThe\n Forcepoint Web Security portal allows administrators to generate \ndetailed reports on user requests made through the Web proxy. It has \nbeen determined that the \"user agent\" field in the Transaction Viewer is\n vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, \nwhich can be exploited by any user who can route traffic through the \nForcepoint Web proxy.\n\nThis \nvulnerability enables unauthorized attackers to execute JavaScript \nwithin the browser context of a Forcepoint administrator, thereby \nallowing them to perform actions on the administrator\u0027s behalf. Such a \nbreach could lead to unauthorized access or modifications, posing a \nsignificant security risk.\n\n\n\n\n\n\nThis issue affects Web Security: before 8.5.6."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de neutralizaci\u00f3n inadecuada de la entrada durante la generaci\u00f3n de p\u00e1ginas web (\u0027cross-site Scripting\u0027) en Forcepoint Web Security (Transaction Viewer) permite XSS Almacenado. El portal Forcepoint Web Security permite a los administradores generar informes detallados sobre las solicitudes de los usuarios realizadas a trav\u00e9s del proxy web. Se ha determinado que el campo \"agente de usuario\" en el Visor de transacciones es vulnerable a una vulnerabilidad persistente de Cross-Site Scripting (XSS), que puede ser explotada por cualquier usuario que pueda enrutar el tr\u00e1fico a trav\u00e9s del proxy web de Forcepoint. Esta vulnerabilidad permite a atacantes no autorizados ejecutar JavaScript dentro del contexto del navegador de un administrador de Forcepoint, permiti\u00e9ndoles as\u00ed realizar acciones en nombre del administrador. Una infracci\u00f3n de este tipo podr\u00eda dar lugar a modificaciones o accesos no autorizados, lo que plantear\u00eda un riesgo de seguridad importante. Este problema afecta a Web Security: versiones anteriores a 8.5.6."
    }
  ],
  "id": "CVE-2023-6452",
  "lastModified": "2024-08-23T16:18:28.547",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "psirt@forcepoint.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-08-22T16:15:07.997",
  "references": [
    {
      "source": "psirt@forcepoint.com",
      "url": "https://support.forcepoint.com/s/article/000042212"
    }
  ],
  "sourceIdentifier": "psirt@forcepoint.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "psirt@forcepoint.com",
      "type": "Secondary"
    }
  ]
}

GHSA-85FC-RR25-P568

Vulnerability from github – Published: 2024-08-22 18:31 – Updated: 2024-08-22 18:31

Details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.

The Forcepoint Web Security portal allows administrators to generate detailed reports on user requests made through the Web proxy. It has been determined that the "user agent" field in the Transaction Viewer is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, which can be exploited by any user who can route traffic through the Forcepoint Web proxy.

This vulnerability enables unauthorized attackers to execute JavaScript within the browser context of a Forcepoint administrator, thereby allowing them to perform actions on the administrator's behalf. Such a breach could lead to unauthorized access or modifications, posing a significant security risk.

This issue affects Web Security: before 8.5.6.

Severity ?

9.6 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-6452"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-22T16:15:07Z",
    "severity": "CRITICAL"
  },
  "details": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.\n\n\n\n\n\nThe\n Forcepoint Web Security portal allows administrators to generate \ndetailed reports on user requests made through the Web proxy. It has \nbeen determined that the \"user agent\" field in the Transaction Viewer is\n vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, \nwhich can be exploited by any user who can route traffic through the \nForcepoint Web proxy.\n\nThis \nvulnerability enables unauthorized attackers to execute JavaScript \nwithin the browser context of a Forcepoint administrator, thereby \nallowing them to perform actions on the administrator\u0027s behalf. Such a \nbreach could lead to unauthorized access or modifications, posing a \nsignificant security risk.\n\n\n\n\n\n\nThis issue affects Web Security: before 8.5.6.",
  "id": "GHSA-85fc-rr25-p568",
  "modified": "2024-08-22T18:31:21Z",
  "published": "2024-08-22T18:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6452"
    },
    {
      "type": "WEB",
      "url": "https://support.forcepoint.com/s/article/000042212"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2023-6452

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2023-6452

Aliases

CVE-2023-6452

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-6452",
    "id": "GSD-2023-6452"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-6452"
      ],
      "id": "GSD-2023-6452",
      "modified": "2023-12-13T01:20:33.016687Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2023-6452",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-6452 (GCVE-0-2023-6452)

FKIE_CVE-2023-6452

GHSA-85FC-RR25-P568

GSD-2023-6452

Tags

Sightings

Nomenclature