CVE-2020-23450: 
Spiceworks Inventory vulnerability analysis and mitigation

Spiceworks Version <= 7.5.00107 is affected by a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed in August 2020, as indicated by the CVE record creation date of August 13, 2020 (MITRE CVE).

The vulnerability exists in the Custom Groups function where any name typed is vulnerable to stored XSS as they are displayed on http://127.0.0.1/inventory/groups/ without proper output sanitization (MITRE CVE).

When successfully exploited, this stored XSS vulnerability could allow attackers to inject malicious scripts that would execute in users' browsers when viewing the affected inventory groups page. This could lead to session hijacking, credential theft, or other client-side attacks (MITRE CVE).

The vulnerability is present in the Custom Groups functionality and can be exploited by injecting malicious scripts through group names, which are then stored and executed when other users view the inventory groups page (MITRE CVE).

Users should upgrade to a version newer than 7.5.00107 of Spiceworks. Until an upgrade is possible, administrators should carefully monitor and restrict access to the Custom Groups functionality (Spiceworks).