CVE-2023-46596 — MEDIUM (5.1)

Vulnerability Description

Improper input validation in Algosec FireFlow VisualFlow workflow editor via Name, Description and Configuration File field in version A32.20, A32.50, A32.60 permits an attacker to initiate an XSS attack by injecting malicious executable scripts into the application's code. Fixed in version A32.20 (b600 and above), A32.50 (b430 and above), A32.60 (b250 and above)

CVSS Score

5.1

MEDIUM

CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L

Attack Vector

ADJACENT_NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Algosec	Fireflow	a32.20

Related Weaknesses (CWE)

CWE-79

References

https://www.algosec.com/docs/en/cves/Content/tech-notes/cves/cve-2023-46596.htmVendor Advisory
https://www.algosec.com/docs/en/cves/Content/tech-notes/cves/cve-2023-46596.htmVendor Advisory

FAQ

What is CVE-2023-46596?

CVE-2023-46596 is a vulnerability with a CVSS score of 5.1 (MEDIUM). Improper input validation in Algosec FireFlow VisualFlow workflow editor via Name, Description and Configuration File field in version A32.20, A32.50, A32.60 permits an attacker to initiate an XSS at...

How severe is CVE-2023-46596?

CVE-2023-46596 has been rated MEDIUM with a CVSS base score of 5.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-46596?

Check the references section above for vendor advisories and patch information. Affected products include: Algosec Fireflow.