CVE-2023-0125 - CVE House

Back to Database

Status published Low CVE-2023-0125

Control iD Gerencia Web Web Interface cross site scripting

2.4 CVSS

Vulnerability Description

A vulnerability was found in Control iD Gerencia Web 1.30. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation of the argument Nome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-217717 was assigned to this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-0125

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

SQU4NCH
Leonardo Teodoro (VulDB User)
Leonardo Teodoro (VulDB User)

References

More from Control iD

View All →

Control iD RH iD PDF Document companyId resource injection

Control iD RH iD API change_password cross site scripting

Control iD iDSecure passwordCustom Authentication Bypass

Control iD Gerencia Web Cookie cleartext storage

Control iD RHiD direct request

Affected Vendor

Control iD

View all reports →

Affected Software

Gerencia Web

Vulnerable Versions:

1.30

Timeline

Official Publish: January 9th, 2023

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement