CVE-2023-41165: XSS
An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 before 4.3.22, and 4.4.0 through 4.6.8 before 4.6.9. An administrator with write access to the SNS firewall can configure a login disclaimer with malicious JavaScript elements that can result in data theft.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-41165?
CVE-2023-41165 has a medium severity rating due to the potential for unauthorized access and configuration changes by administrators.
How do I fix CVE-2023-41165?
To fix CVE-2023-41165, administrators should upgrade the Stormshield Network Security (SNS) to version 3.7.39, 3.11.27, 4.3.22, or 4.6.9 or later.
Who is affected by CVE-2023-41165?
CVE-2023-41165 affects users of Stormshield Network Security (SNS) versions 3.7.0 to 3.7.38, 3.10.0 to 3.11.26, 4.0 to 4.3.21, and 4.4.0 to 4.6.8.
What types of attacks does CVE-2023-41165 allow?
CVE-2023-41165 could allow an attacker with write access to the SNS firewall to configure a login disclaimer, potentially misleading users.
Is CVE-2023-41165 a zero-day vulnerability?
No, CVE-2023-41165 is not classified as a zero-day vulnerability since a patch is available from the vendor.