CVE-2023-6098: Cross-site Scripting on ICSSolution ICS Business Manager

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-13 · updated 2026-06-17
Weakness: CWE-79

Description

An XSS vulnerability has been discovered in ICS Business Manager affecting version 7.06.0028.7066. A remote attacker could send a specially crafted string exploiting the obdd_act parameter, allowing the attacker to steal an authenticated user's session, and perform actions within the application.

Affected products

ICSSolution ICS Business Manager: 7.06.0028.2802, 7.06.0028.7066, 7.06.0028.7089

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-icssolution-ics-business-manager
https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-icssolution-ics-business-manager

Get alerted when CVE-2023-6098 or the next vulnerability affects your stack