CVE-2023-26061
Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NetAct

In NetAct working set manager, input validation is not properly implemented in creating a schedule task in alarm reports dashboard function. This vulnerability may result in injecting XSS by a creating a malicious script on the scheduled search tab under alarm reports dashboard page.

This vulnerability is very difficult to be exploited from external, because a few dynamically created parameters (e.g. Jsession-id, CSRF token and Nxsrf tokens) would be needed. The attack can only be performed by an internal user.

Fix has been provided on top of NetAct 22

• Vladimir Razov from Positive Technologies
• Aleksandr Ustinov from Positive Technologies