CVE-2023-26060
Cross Site Template Injection Vulnerability in Nokia NetAct

In NetAct working set manager, input validation is not properly implemented in creating a working set function. This vulnerability may result in injecting a client side template injection payloads when NetAct users create a working set with malicious codes in the name. 

This vulnerability is very difficult to be exploited from external, because a few dynamically created parameters (e.g. Jsession-id, CSRF token and Nxsrf tokens) would be needed. The attack can only be performed by an internal user.

Fix has been provided on top of NetAct 22

• Vladimir Razov from Positive Technologies
• Aleksandr Ustinov from Positive Technologies