Qsige
CVE-2023-4100
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
Lifecycle Timeline
1DescriptionNVD
Allows an attacker to perform XSS attacks stored on certain resources. Exploiting this vulnerability can lead to a DoS condition, among other actions.
AnalysisAI
Allows an attacker to perform XSS attacks stored on certain resources. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Allows an attacker to perform XSS attacks stored on certain resources. Exploiting this vulnerability can lead to a DoS condition, among other actions. Affected products include: Qsige.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
QSige statistics are affected by a remote SQLi vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remo
QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficien
It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS
The file upload functionality is not implemented correctly and allows uploading of any type of file. Rated high severity
The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has suffi
The QSige Monitor application does not have an access control mechanism to verify whether the user requesting a resource
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today