CyberRota Analysis
AI-GeneratedA stored cross-site scripting vulnerability in Kiteworks Core affects Java applications, allowing a low-privileged administrator to inject malicious JavaScript that executes in the context of a System Administrator's session. This could lead to unauthorized escalation of privileges, enabling the attacker to gain full administrative control over the tenant, including the ability to create new administrative accounts. Organizations using Kiteworks Core should prioritize patching this vulnerability to protect against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected page. This could have permitted the lower-privileged administrator to escalate to full administrative control of the tenant, including the creation of a new administrative account.
Related CVEs
Other vulnerabilities affecting the same vendor(s)