« Volver al listado

CVE-2023-21523

Estado: ModificadaMedia (5.4)—

A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Blackberry — Athoc

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-21523",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-21523",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-25T20:01:14.262121Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "secure@blackberry.com",
      "affectedData": [
        {
          "vendor": "BlackBerry",
          "product": "AtHoc",
          "versions": [
            {
              "status": "affected",
              "version": "7.15"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-09-12T20:15:08.010",
  "references": [
    {
      "url": "https://http://support.blackberry.com/kb/articleDetail?articleNumber=000112406",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@blackberry.com"
    },
    {
      "url": "https://http://support.blackberry.com/kb/articleDetail?articleNumber=000112406",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nA Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account.\n\n\n\n\n\n\n\n"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Cross-site Scripting (XSS) almacenado en la Consola de Administración (Administración de Usuarios y Alertas) de BlackBerry AtHoc versión 7.15 podría permitir a un atacante ejecutar comandos de script en el contexto de la cuenta de usuario afectada."
    }
  ],
  "lastModified": "2026-06-17T05:33:04.867",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:blackberry:athoc:7.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D7D98E8-462C-40B1-8106-B361BAF3448B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@blackberry.com"
}