Genesys PureConnect - Interaction Web Tools XSS

Risk: Low
Local: No
Remote: Yes

Product: Genesys PureConnect - Interaction Web Tools Chat Service Description: Interaction Web Tools Chat Service allows XSS within the Printable Chat History via the participant -> name JSON POST parameter. Vulnerability Type: XSS Vendor of Product: Genesys PureConnect Affected Product Code Base: Interaction Web Tools - Chat Service - Appears to be all versions up to current release (26-September-2019) Affected Component: "Print" feature of the Interaction Web Tools Chat: Attack Vectors: • To exploit the Cross-Site Scripting vulnerability, visit https://<vulnerable-domain>/I3Root/chatOrCallback.html • Then select the 'I don't have an account" option, and enter the name "><script>alert(1)</script> • Then press 'Start Chat' • Then enter anything in the chat box like 'asdfg' and press send • Now select the 'Printable Chat History' in the top right corner • XSS will trigger. You can google dork for vulnerable versions with inurl:"/I3Root/chatOrCallback.html" I'm assuming if an admin tries to print the chat conversation, it will trigger for them as well. Unable to confirm though.


Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022,


Back to Top