Webswing vulnerabilities
We track 2 vulnerabilities in Webswing products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 31, 2024.
2vulnerabilities
2critical
0high
0exploited
9.8average CVSS score
Latest Webswing vulnerabilities
- 9.8 Critical severity
webswing: Improper Limitation of a Pathname to a Restricted Directory
Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execution via modification of shell scripts on the server.
- 9.8 Critical severity
Webswing: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Webswing before 22.1.3 allows X-Forwarded-For header injection. The client IP address is associated with a variable in the configuration page. The {clientIp} variable can be used as an application startup argument. The X-Forwarded-For header can be manipulated