CVE-2023-36287

Summary

CVE-2023-36287 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Webkul QloApps 1.6.0. An attacker can exploit this flaw to inject malicious scripts into a victim's web browser, gaining access to their session cookie. Once obtained, the attacker can impersonate the user and execute unauthorized actions using their POST controller parameters. This vulnerability poses a significant risk, as it allows attackers to bypass authentication mechanisms and potentially steal sensitive information or conduct unauthorized transactions. Webkul is strongly advised to release an update to address this issue promptly.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.