VulnerabilityModified

CVE-2023-23208

Genesys Administrator Extension (GAX) before 9.0.105.15 is vulnerable to Cross Site Scripting (XSS) via the Business Structure page of the iWD plugin, aka GAX-11261.

MEDIUM 6.1EPSS 0.35%

Does this matter?

Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own.

Description

Genesys Administrator Extension (GAX) before 9.0.105.15 is vulnerable to Cross Site Scripting (XSS) via the Business Structure page of the iWD plugin, aka GAX-11261.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.35% probability · 29th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: genesys/administrator extension
Source: cve@mitre.org

References

https://docs.genesys.com/Documentation/RN/9.0.x/gax90rn/gax9010515Vendor Advisory
https://docs.genesys.com/Documentation/RN/9.0.x/gax90rn/gax9010515Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.