Verint Verba Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Verint Verba software, affecting all versions prior to 10.0.6. This vulnerability arises within the login logging mechanism, where an unauthenticated remote attacker can inject a malicious XSS payload into the username field. The injected payload is executed in the context of the administrator's browser when the log viewer is accessed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the administrator.

Remediation

Users can upgrade to Verint Verba version 10.0.6 or later to address this vulnerability.