CVE-2023-23949
Published: 26 January 2023
Summary
CVE-2023-23949 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Broadcom Symantec Identity Governance And Administration. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 27.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28014
Vulnerability details
An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Audit record reduction explicitly manages excessive log volumes for review and reporting while preserving original content and ordering, reducing the impact of logging excessive data.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.