CVE-2023-4951
Assigner: GreenRocketSecurity
Published: 2023-09-14T16:43:40.721Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: GreenRADIUS
vendor: Green Rocket Security
versions: lessThanOrEqual: 5.1.1.1
status: affected
version: 0
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Jay Sharma, Application Security Analyst, Qualys, Inc.
datePublic: 2023-09-13T21:15:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: A cross site scripting issue was discovered with the pagination function on the "Client-based Authentication Policy Configuration" screen of the GreenRADIUS web admin interface.&nbsp;<span style="background-color: rgb(255, 255, 255);">This issue is found in GreenRADIUS v5.1.1.1 and prior. A fix was included in v5.1.2.2.</span>

<br>
value: A cross site scripting issue was discovered with the pagination function on the "Client-based Authentication Policy Configuration" screen of the GreenRADIUS web admin interface. This issue is found in GreenRADIUS v5.1.1.1 and prior. A fix was included in v5.1.2.2.



impacts: capecId: CAPEC-63
descriptions: value: CAPEC-63 Cross-Site Scripting (XSS)
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Upgrade to GreenRADIUS v5.1.2.2 or later<br>
value: Upgrade to GreenRADIUS v5.1.2.2 or later

source: discovery: EXTERNAL
title: Cross Site Scripting (XSS) Issue on "Client Based Authentication Policy Configuration" Screen
x_generator: engine: SecretariatVulnogram 0.1.0-dev