CVE-2023-41165

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-29 · updated 2026-06-17
Weakness: CWE-79

Description

An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 before 4.3.22, and 4.4.0 through 4.6.8 before 4.6.9. An administrator with write access to the SNS firewall can configure a login disclaimer with malicious JavaScript elements that can result in data theft.

Affected products

Stormshield Network Security: from 3.7.0 before 3.7.39; from 3.10.0 before 3.11.27; from 4.0.0 before 4.3.22; from 4.4.0 before 4.6.9 — fixed in 3.11.27, 3.7.39, 4.3.22, 4.6.9

How to fix

Upgrade to a fixed version: Stormshield Network Security 3.11.27, 3.7.39, 4.3.22, 4.6.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-41165 or the next vulnerability affects your stack