CVE-2023-6072

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-13 · updated 2026-06-17
Weakness: CWE-79

Description

A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to craft CM dashboard internal requests causing arbitrary content to be injected into the response when accessing the CM dashboard.

Affected products

Trellix Central Management (CM): before 9.1.3.97129 — fixed in 9.1.3.97129

How to fix

Upgrade to a fixed version: Trellix Central Management (CM) 9.1.3.97129. Check the vendor advisory for mitigations.

References

https://docs.trellix.com/bundle/cm_9-1-5_rn/page/UUID-fad8a50f-6f6f-e970-f418-06494a30932e.html
https://docs.trellix.com/bundle/cm_9-1-5_rn/page/UUID-fad8a50f-6f6f-e970-f418-06494a30932e.html

Get alerted when CVE-2023-6072 or the next vulnerability affects your stack