CVE-2023-50924

Summary

CVE-2023-50924 is a vulnerability affecting Engelsystem, a shift planning system for chaos events. Prior to version 3.4.1, Engelsystem failed to adequately validate user-supplied data for DECT numbers, mobile numbers, and work-log comment fields. An authenticated user could exploit this weakness by injecting malicious Javascript code into these fields. The injected code would be executed in another user's context when they viewed corresponding log overviews, leading to potential unauthorized actions. This issue has been addressed in version 3.4.1.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.