CVE-2023-32000: 
Ubiquiti UniFi vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability (CVE-2023-32000) was discovered in UniFi Network version 7.3.83 and earlier. The vulnerability was disclosed in July 2023 and affects the UniFi Network Application (NVD).

The vulnerability is a Cross-Site Scripting (XSS) issue that allows a malicious actor with Site Administrator credentials to escalate privileges by persuading an Administrator to visit a malicious web page. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.8 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The weakness is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

If successfully exploited, the vulnerability could allow an attacker with Site Administrator privileges to escalate their privileges by tricking an Administrator into visiting a malicious webpage. The impact is considered moderate with low confidentiality and integrity impact, but no availability impact (NVD).

The vulnerability requires the attacker to already have Site Administrator credentials and relies on user interaction (convincing an Administrator to visit a malicious web page) for successful exploitation. The attack complexity is considered low, but the prerequisite of having Site Administrator access makes it more difficult to exploit (NVD).

Users are advised to upgrade their UniFi Network Application to a version newer than 7.3.83 to address this vulnerability (NVD).