By combining AI with human insight, Armis Vulnerability Intelligence Database offers extended coverage for vulnerabilities that matter to you, your industry, and provides you with clear remediation instructions.
Loading CVE list…
CVE Name
Severity Score
Published Date
CISA KEV
Take These Insights to the Next Level
Armis now offers direct API access to Armis Vulnerability Intelligence Database through the AWS Marketplace, transforming it from a powerful research tool into an integrated component of your proactive security posture.
Seamless Integration: Directly feed Armis's contextual data into your existing stack.
Automated Workflows: Automate vulnerability lookups in real-time.
Custom Solutions: Use the raw data to build custom dashboards, reports, alerts.
See everything.Identify true risk.Proactively mitigate threats.Book a Demo
Let's talk!
CVE-2023-7259:
Loading CVE details…
CVE-2023-7259 | Low Severity | Armis
could allow injection of arbitrary HTML/JavaScript. The issue is described as remotely exploitable with the exploit publicly disclosed; however, it is marked as disputed by the vendor, who argues that XSS requiring administrative privileges would have limited attacker value. The vulnerability is scored with multiple CVSS vectors, indicating a MEDIUM severity in CVSS v4.0 and LOW severity in CVSS v3.x, and is associated with the affected Adduser Page module.\n","datePublished":"2024-05-24T07:15:08.000Z","dateModified":"2026-05-13T09:06:53.377Z","keywords":"Low, 2024, CVE, vulnerability, cybersecurity, CVSS","url":"https://cve.armis.com/CVE-2023-7259","author":{"@type":"Organization","name":"Armis","url":"https://www.armis.com"},"publisher":{"@type":"Organization","name":"Armis","url":"https://www.armis.com"},"license":"https://creativecommons.org/licenses/by-nc-sa/4.0/","isBasedOn":{"@type":"WebPage","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7259","name":"NVD CVE-2023-7259"},"additionalProperty":[{"@type":"PropertyValue","name":"CVSS Score","value":"2.4"},{"@type":"PropertyValue","name":"Severity","value":"Low"},{"@type":"PropertyValue","name":"EPSS Score","value":"0.10%"},{"@type":"PropertyValue","name":"EPSS Percentile","value":"26th"},{"@type":"PropertyValue","name":"Attack Vector","value":"NETWORK"},{"@type":"PropertyValue","name":"Attack Complexity","value":"LOW"},{"@type":"PropertyValue","name":"Privileges Required","value":"HIGH"},{"@type":"PropertyValue","name":"User Interaction","value":"REQUIRED"},{"@type":"PropertyValue","name":"Scope","value":"UNCHANGED"},{"@type":"PropertyValue","name":"Confidentiality Impact","value":"NONE"},{"@type":"PropertyValue","name":"Integrity Impact","value":"LOW"},{"@type":"PropertyValue","name":"Availability Impact","value":"NONE"}]},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is CVE-2023-7259?","acceptedAnswer":{"@type":"Answer","text":"Disputed cross-site scripting vulnerability in zzdevelop lenosp Adduser Page (version 20230831) that could allow a remote attacker to inject script via the username parameter; the exploit has been publicly disclosed, but the vendor questions the existence and usefulness of the flaw (XSS that would require administrative privileges).\n"}},{"@type":"Question","name":"How severe is CVE-2023-7259?","acceptedAnswer":{"@type":"Answer","text":"CVE-2023-7259 has a CVSS score of 2.4 (Low severity). EPSS score: 0.10% (26th percentile), indicating the estimated probability of exploitation in the wild."}},{"@type":"Question","name":"How do I fix CVE-2023-7259?","acceptedAnswer":{"@type":"Answer","text":"Remediation steps (where applicable) \n- Verify vulnerability status with the vendor and obtain any official patched versions or advisories. If a fixed version exists, upgrade to that version promptly. \n- Implement input validation on the username field (allowlist only permitted characters such as letters, digits, and a minimal set of punctuation). \n- Ensure proper output encoding/escaping for the username when rendering on HTML pages to prevent injection. Use templating engines or frameworks that auto-escape user-supplied data. \n- Enable and enforce a strong Content Security Policy (CSP) to reduce the risk of injected scripts executing in the browser. \n- Review and harden Adduser Page implementations and any dynamic HTML rendering to avoid reflecting unsanitized input. \n- Consider additional protective controls such as WAF rules to neutralize suspicious input patterns (e.g., stripping or encoding script tags), while not relying solely on WAF for protection. \n- Restrict access to the Adduser Page to authorized users with least-privilege principles and ensure robust authentication/authorization checks. \n- Conduct targeted security testing (DAST/SAST) focusing on XSS vectors in the Adduser Page, and validate that mitigations are effective. \n- Document and monitor for any vendor-specified fixes or advisories and re-assess risk after applying patches or mitigations.\n\nNote: Given the dispute surrounding the vulnerability, treat any remediation as precautionary and align with vendor guidance and organizational risk tolerance.\n"}}]},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://cve.armis.com/"},{"@type":"ListItem","position":2,"name":"CVE-2023-7259","item":"https://cve.armis.com/CVE-2023-7259"}]}]
CVE-2023-7259:
Disputed cross-site scripting vulnerability in zzdevelop lenosp Adduser Page (version 20230831) that could allow a remote attacker to inject script via the username parameter; the exploit has been publicly disclosed, but the vendor questions the existence and usefulness of the flaw (XSS that would require administrative privileges).
Score
A numerical rating that indicates how dangerous this vulnerability is.
2.4Low
Published Date:May 24, 2024
CISA KEV Date:*No Data*
Industries Affected:20
Threat Predictions
EPSS Score:0.1
EPSS Percentile:26%
Exploitability
Score:0.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:HIGH
User Interaction:REQUIRED
Scope:UNCHANGED
Impact
Score:1.4
Confidentiality Impact:NONE
Integrity Impact:LOW
Availability Impact:NONE
Description Preview
Disputed cross-site scripting vulnerability in zzdevelop lenosp Adduser Page (version 20230831) that could allow a remote attacker to inject script via the username parameter; the exploit has been publicly disclosed, but the vendor questions the existence and usefulness of the flaw (XSS that would require administrative privileges).
Overview
An XSS vulnerability (CWE-79) affecting zzdevelop lenosp prior to or including 20230831 on the Adduser Page has been reported, where manipulating the username input with crafted content such as alert(1) could allow injection of arbitrary HTML/JavaScript. The issue is described as remotely exploitable with the exploit publicly disclosed; however, it is marked as disputed by the vendor, who argues that XSS requiring administrative privileges would have limited attacker value. The vulnerability is scored with multiple CVSS vectors, indicating a MEDIUM severity in CVSS v4.0 and LOW severity in CVSS v3.x, and is associated with the affected Adduser Page module.
Remediation
Remediation steps (where applicable)
Verify vulnerability status with the vendor and obtain any official patched versions or advisories. If a fixed version exists, upgrade to that version promptly.
Implement input validation on the username field (allowlist only permitted characters such as letters, digits, and a minimal set of punctuation).
Ensure proper output encoding/escaping for the username when rendering on HTML pages to prevent injection. Use templating engines or frameworks that auto-escape user-supplied data.
Enable and enforce a strong Content Security Policy (CSP) to reduce the risk of injected scripts executing in the browser.
Review and harden Adduser Page implementations and any dynamic HTML rendering to avoid reflecting unsanitized input.
Consider additional protective controls such as WAF rules to neutralize suspicious input patterns (e.g., stripping or encoding script tags), while not relying solely on WAF for protection.
Restrict access to the Adduser Page to authorized users with least-privilege principles and ensure robust authentication/authorization checks.
Conduct targeted security testing (DAST/SAST) focusing on XSS vectors in the Adduser Page, and validate that mitigations are effective.
Document and monitor for any vendor-specified fixes or advisories and re-assess risk after applying patches or mitigations.
Note: Given the dispute surrounding the vulnerability, treat any remediation as precautionary and align with vendor guidance and organizational risk tolerance.
