CVE-2023-5026: XSS in Tongda OA 11.10

Successful exploitation of CVE-2023-5026 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can be leveraged to steal sensitive information, such as session cookies, which would grant the attacker unauthorized access to the user's account. Furthermore, the attacker could redirect users to malicious websites, deface the application, or inject malware. The impact is amplified if the application is used to manage sensitive data or handle financial transactions, as an attacker could potentially gain access to confidential information or manipulate critical operations. The remote nature of the vulnerability means an attacker does not need to be on the same network as the server to exploit it.

1. Reserved2023-09-16
2. Published2023-09-17
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-5026 is to upgrade Tongda OA to version 11.10.1 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the OASUBWINDOW parameter to sanitize user-supplied data. Web application firewalls (WAFs) can be configured to block requests containing suspicious patterns in the OASUBWINDOW parameter. Regularly review and update security policies to ensure they address XSS vulnerabilities.