What’s Vulnerable › Vulnerabilities

CVE-2023-49950

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-02-03 · updated 2026-06-17
• Weakness: CWE-79

Description

The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a cross-site scripting (XSS) payload and send it to any system or device that sends logs to the SIEM. If an alert is created, the payload will execute upon the alert data being viewed with that template, which can lead to sensitive data disclosure.

Affected products

• Logpoint SIEM: from 6.10.0 before 7.3.0 — fixed in 7.3.0

How to fix

Upgrade to a fixed version: Logpoint SIEM 7.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/shrikeinfosec/cve-2023-49950/blob/main/cve-2023-49950.md
• https://servicedesk.logpoint.com/hc/en-us/articles/14124495377437-Stored-XSS-Vulnerability-in-Alerts-via-Log-Injection
• https://github.com/shrikeinfosec/cve-2023-49950/blob/main/cve-2023-49950.md
• https://servicedesk.logpoint.com/hc/en-us/articles/14124495377437-Stored-XSS-Vulnerability-in-Alerts-via-Log-Injection

Get alerted when CVE-2023-49950 or the next vulnerability affects your stack