Tribalsystems Zenario CMS: Reflected XSS (CVE-2023-44770)

CVE-2023-44770 is a reflected cross-site scripting (XSS) vulnerability affecting Tribalsystems Zenario CMS version 9.4.59197. The vulnerability exists due to insufficient input sanitization within the "Organizer - Spare alias" configuration field. An authenticated user can inject arbitrary JavaScript, which executes in the context of the administrative session when accessed.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript within the administrative panel. This could lead to session hijacking, unauthorized administrative actions, or the modification of site content, depending on the privileges of the victim viewing the malicious alias.

Recommendation

• Audit Zenario CMS instances to identify if version 9.4.59197 is in use.
• Apply security patches or updates provided by Tribalsystems to remediate the vulnerability.
• Implement a Content Security Policy (CSP) to mitigate the impact of reflected XSS attacks in the administrative interface.
• Monitor administrative logs for suspicious modifications to Organizer settings or aliases.