Flexense Disk Pulse Enterprise Authenticated Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Disk Pulse Enterprise version 10.4.18. This vulnerability exists in the '/monitor_directory?sid=' endpoint and is caused by inadequate validation of the 'monitor_directory' parameter in POST requests. An authenticated attacker could exploit this vulnerability to inject malicious content, potentially leading to the theft of session information from the user.

Impact

Exploitation of this vulnerability allows for authenticated reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's session.