CVE-2023-49575

A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, in Sync Breeze Enterprise Server 10.4.18 version, and in Disk Pulse Enterprise 10.4.18 version, that could allow an attacker to execute persistent XSS through /setup_smtp in smtp_server, smtp_user, smtp_password and smtp_email_address parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise	Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:flexense:vx_search:10.2.14:*:*:*:enterprise:*:*:*

History

21 May 2025, 12:16

Type	Values Removed	Values Added
Summary	(en) A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /setup_smtp in smtp_server, smtp_user, smtp_password and smtp_email_address parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.	(en) A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, in Sync Breeze Enterprise Server 10.4.18 version, and in Disk Pulse Enterprise 10.4.18 version, that could allow an attacker to execute persistent XSS through /setup_smtp in smtp_server, smtp_user, smtp_password and smtp_email_address parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.

04 Mar 2025, 17:00

Type	Values Removed	Values Added
First Time		Flexense Flexense vx Search
CPE		cpe:2.3:a:flexense:vx_search:10.2.14::::enterprise:::
References	~~() https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise -~~	() https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise - Third Party Advisory

21 Nov 2024, 08:33

Type	Values Removed	Values Added
References	~~() https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise -~~	() https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise -
Summary		(es) Se ha descubierto una vulnerabilidad en VX Search Enterprise que afecta a la versión 10.2.14 y que podría permitir a un atacante ejecutar XSS persistente a través de /setup_smtp en los parámetros smtp_server, smtp_user, smtp_password y smtp_email_address. Esta vulnerabilidad podría permitir que un atacante almacene payloads de JavaScript maliciosos en el sistema para que se activen cuando se carga la página.

24 May 2024, 18:09

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-05-24 13:15

Updated : 2025-05-21 12:16

NVD link : CVE-2023-49575

Mitre link : CVE-2023-49575

CVE.ORG link : CVE-2023-49575

JSON object : View

Products Affected

flexense

vx_search

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-49575", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-05-24T13:15:09.360", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise", "tags": ["Third Party Advisory"], "source": "cve-coordination@incibe.es"}, {"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, in\u00a0Sync Breeze Enterprise Server 10.4.18 version, and in\u00a0Disk Pulse Enterprise\u00a010.4.18 version, that could allow an attacker to execute persistent XSS through /setup_smtp in smtp_server, smtp_user, smtp_password and smtp_email_address parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad en VX Search Enterprise que afecta a la versi\u00f3n 10.2.14 y que podr\u00eda permitir a un atacante ejecutar XSS persistente a trav\u00e9s de /setup_smtp en los par\u00e1metros smtp_server, smtp_user, smtp_password y smtp_email_address. Esta vulnerabilidad podr\u00eda permitir que un atacante almacene payloads de JavaScript maliciosos en el sistema para que se activen cuando se carga la p\u00e1gina."}], "lastModified": "2025-05-21T12:16:13.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flexense:vx_search:10.2.14:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "8981E803-BBFF-4DDB-AF9F-21B098B589B7"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@incibe.es"}

7.1 /10