CVE-2023-49111

Medium

Description

For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a JavaScript block in the response. This is especially critical in business environments using AD SSO authentication, e.g. via ADFS, where attackers could potentially steal AD passwords. This issue affects Kiuwan SAST: <master.1808.p685.q13371

SeverityMedium

CVSS6.5

Exploit probability—

ProductSAST

PublishedJun 20, 2024

First seenJun 20, 2024

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Vendor advisories

kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log

Affected products

Product	Affected versions	Fixed in
Kiuwan SAST	<master.1808.p685.q13371	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.