CVE-2023-49573: 
VX Search vulnerability analysis and mitigation

A vulnerability (CVE-2023-49573) has been discovered in VX Search Enterprise version 10.2.14, which allows attackers to execute persistent Cross-Site Scripting (XSS) through the /add_command_action endpoint in the action_value parameter. The vulnerability was disclosed on May 24, 2024, and was reported by Rafael Pedrero to the Spanish National Cybersecurity Institute (INCIBE) (INCIBE Advisory).

The vulnerability is classified as a CWE-79 (Improper Neutralization of Input During Web Page Generation) issue. It has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed, with low impacts on confidentiality, integrity, and availability (INCIBE Advisory).

The vulnerability enables attackers to store malicious JavaScript payloads on the system, which are then triggered when the page loads. This persistent XSS vulnerability could potentially lead to compromised user sessions, data theft, and unauthorized actions performed on behalf of legitimate users (INCIBE Advisory).

The vulnerability requires network access and user interaction to be exploited. The low attack complexity suggests that exploitation is relatively straightforward once the necessary conditions are met (INCIBE Advisory).

As of the disclosure date, no official solution or patch has been reported for this vulnerability (INCIBE Advisory).