Vulnerability Description
In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited by an internal unauthenticated attacker for JavaScript execution in the context of the user trying to authenticate.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Veridiumid | Veridiumad | < 3.5.0 |
Related Weaknesses (CWE)
References
- https://docs.veridiumid.com/docs/v3.5/security-advisory#id-%28v3.52%29SecurityAdThird Party Advisory
- https://veridiumid.com/veridium-id-authentication-platform/Product
- https://docs.veridiumid.com/docs/v3.5/security-advisory#id-%28v3.52%29SecurityAdThird Party Advisory
- https://veridiumid.com/veridium-id-authentication-platform/Product
FAQ
What is CVE-2023-44040?
CVE-2023-44040 is a vulnerability with a CVSS score of 6.1 (MEDIUM). In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited by an internal unauthenticated attacker for JavaScript executi...
How severe is CVE-2023-44040?
CVE-2023-44040 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-44040?
Check the references section above for vendor advisories and patch information. Affected products include: Veridiumid Veridiumad.