CVE-2023-5451 - Vulnerability Details - OpenCVE

ReportizFlow

Forcepoint NGFW Security Management Center Management Server has SMC Downloads optional feature to offer standalone Management Client downloads and ECA configuration downloads. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS. This issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Forcepoint	Next Generation Firewall Security Management Center

No data.

No data.

References

Link	Providers
https://support.forcepoint.com/s/article/000042395

History

No history.

MITRE

Status: PUBLISHED

Assigner: forcepoint

Published: 2024-03-04T15:54:43.711Z

Updated: 2024-08-02T07:59:44.679Z

Reserved: 2023-10-06T16:47:41.779Z

Link: CVE-2023-5451

Vulnrichment

Updated: 2024-07-05T15:20:41.242Z

NVD

Status : Awaiting Analysis

Published: 2024-03-04T16:15:49.490

Modified: 2024-11-21T08:41:47.633

Link: CVE-2023-5451

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5451", "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2", "state": "PUBLISHED", "assignerShortName": "forcepoint", "dateReserved": "2023-10-06T16:47:41.779Z", "datePublished": "2024-03-04T15:54:43.711Z", "dateUpdated": "2024-08-02T07:59:44.679Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["SMC Downloads"], "product": "Next Generation Firewall Security Management Center ", "vendor": "Forcepoint", "versions": [{"lessThan": "6.10.13", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "7.1.2", "status": "affected", "version": "6.11.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Hazem Osama"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>\nForcepoint\n NGFW Security Management Center Management Server has SMC Downloads \noptional feature to offer standalone Management Client downloads and ECA\n configuration downloads.</div><div>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS.</div><p>This issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.</p>"}], "value": "Forcepoint\n NGFW Security Management Center Management Server has SMC Downloads \noptional feature to offer standalone Management Client downloads and ECA\n configuration downloads.\n\nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS.\n\nThis issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.\n\n"}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2", "shortName": "forcepoint", "dateUpdated": "2024-03-04T15:54:48.825Z"}, "references": [{"url": "https://support.forcepoint.com/s/article/000042395"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nThe vulnerability has been fixed in the SMC releases 6.10.13 and 7.1.2.\n\n<br>"}], "value": "The vulnerability has been fixed in the SMC releases 6.10.13 and 7.1.2.\n\n\n"}], "source": {"discovery": "UNKNOWN"}, "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nTo\n limit the access to the SMC, Forcepoint recommends that the SMC \ndeployment is placed in a dedicated, secure network segment without \nthird-party servers and limited network access. \nAlternatively, Forcepoint recommends disabling Management Server SMC Downloads feature.\n\n\n\n<br>"}], "value": "To\n limit the access to the SMC, Forcepoint recommends that the SMC \ndeployment is placed in a dedicated, secure network segment without \nthird-party servers and limited network access. \nAlternatively, Forcepoint recommends disabling Management Server SMC Downloads feature.\n\n\n\n\n"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-5451", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-04T18:45:01.138819Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:22:06.923Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:59:44.679Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.forcepoint.com/s/article/000042395", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-5451", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-04T18:45:01.138819Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:41.242Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Hazem Osama"}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Forcepoint", "modules": ["SMC Downloads"], "product": "Next Generation Firewall Security Management Center ", "versions": [{"status": "affected", "version": "0", "lessThan": "6.10.13", "versionType": "semver"}, {"status": "affected", "version": "6.11.0", "lessThan": "7.1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The vulnerability has been fixed in the SMC releases 6.10.13 and 7.1.2.\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\nThe vulnerability has been fixed in the SMC releases 6.10.13 and 7.1.2.\n\n<br>", "base64": false}]}], "references": [{"url": "https://support.forcepoint.com/s/article/000042395"}], "workarounds": [{"lang": "en", "value": "To\n limit the access to the SMC, Forcepoint recommends that the SMC \ndeployment is placed in a dedicated, secure network segment without \nthird-party servers and limited network access. \nAlternatively, Forcepoint recommends disabling Management Server SMC Downloads feature.\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\nTo\n limit the access to the SMC, Forcepoint recommends that the SMC \ndeployment is placed in a dedicated, secure network segment without \nthird-party servers and limited network access. \nAlternatively, Forcepoint recommends disabling Management Server SMC Downloads feature.\n\n\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Forcepoint\n NGFW Security Management Center Management Server has SMC Downloads \noptional feature to offer standalone Management Client downloads and ECA\n configuration downloads.\n\nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS.\n\nThis issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.\n\n", "supportingMedia": [{"type": "text/html", "value": "<div>\nForcepoint\n NGFW Security Management Center Management Server has SMC Downloads \noptional feature to offer standalone Management Client downloads and ECA\n configuration downloads.</div><div>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS.</div><p>This issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2", "shortName": "forcepoint", "dateUpdated": "2024-03-04T15:54:48.825Z"}}}, "cveMetadata": {"cveId": "CVE-2023-5451", "state": "PUBLISHED", "dateUpdated": "2024-07-05T17:22:06.923Z", "dateReserved": "2023-10-06T16:47:41.779Z", "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2", "datePublished": "2024-03-04T15:54:43.711Z", "assignerShortName": "forcepoint"}, "dataVersion": "5.1"}