Vulnerability · Published Feb 15, 2024 · Assigned by AlgoSec

CVE-2023-46596Improper input validation in FireFlow’s VisualFlow workflow editor

Medium 5.1

In plain English

A medium-severity cross-site scripting in Algosec FireFlow from Algosec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)5.1Medium

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper input validation in Algosec FireFlow VisualFlow workflow editor via Name, Description and Configuration File field in version A32.20, A32.50, A32.60 permits an attacker to initiate an XSS attack by injecting malicious executable scripts into the application's code. Fixed in version A32.20 (b600 and above), A32.50 (b430 and above), A32.60 (b250 and above)

Affected products (as reported)

Vendor	Product	Versions
Algosec	Algosec FireFlow	A32.20, A32.50, A32.60

Weakness: CWE-79 · Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L

References

https://www.algosec.com/docs/en/cves/Content/tech-notes/cves/cve-2023-46596.htm