CVE search · CVE-2023-6072

CVE-2023-6072

medium 5.4

A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to craft CM dashboard internal requests causing arbitrary content to be injected into the response when accessing the CM dashboard.

Open in the NVD CVE.org JSON

Status: Modified
Published: 2024-02-13
Last changed: 2026-06-17
Source: trellixpsirt@trellix.com
Weakness: CWE-79

Severity

Version	Score	Vector	Source
CVSS 3.1	medium 4.6	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N`	trellixpsirt@trellix.comSecondary
CVSS 3.1	medium 5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`	nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

trellix · central_management_system

References

https://docs.trellix.com/bundle/cm_9-1-5_rn/page/UUID-fad8a50f-6f6f-e970-f418-06494a30932e.htmlPermissions Required
https://docs.trellix.com/bundle/cm_9-1-5_rn/page/UUID-fad8a50f-6f6f-e970-f418-06494a30932e.htmlPermissions Required

CVE-2023-6072

Details

Severity

Affected products

References