CVE-2023-43763

Vulnerability

WithSecure Policy Manager 15 on Windows and Linux contains a cross-site scripting (XSS) vulnerability due to an unvalidated parameter in an endpoint. The specific endpoint and parameter are not disclosed. Affected versions: WithSecure Policy Manager 15.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious request with a script payload in the unvalidated parameter. Successful exploitation requires a victim to access the crafted URL, potentially through social engineering or by embedding it in a web page.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This could lead to session hijacking, sensitive information disclosure, or unauthorized actions on the Policy Manager interface.

Mitigation

No fix has been publicly disclosed as of the publication date. WithSecure has not released a security advisory specifically for this CVE [1]. Users are advised to monitor WithSecure's security advisories for updates and apply any available patches promptly. As a general precaution, restrict access to the Policy Manager web interface and enforce input validation if possible.