Stored XSS on SNS Enrollment Portal
Summary
| CVE | CVE-2026-113808 |
|---|---|
| State | PUBLISHED |
| Assigner | airbus |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-20 19:17:34 UTC |
| Updated | 2026-10-20 19:35:23 UTC |
| Description | A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator. |
Risk And Classification
Primary CVSS: v3.1 7.1 HIGH from [email protected]
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Problem Types: CWE-79 | CWE-79 CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.1 | HIGH | CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 7.1 | HIGH | CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
HighPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Stormshield | Stormshield Network Security | affected 4.3.0 4.3.44 semver | Not specified |
| CNA | Stormshield | Stormshield Network Security | affected 4.8.0 4.8.19 semver | Not specified |
| CNA | Stormshield | Stormshield Network Security | affected 5.0.0 5.0.9 semver | Not specified |
| CNA | Stormshield | Stormshield Network Security | affected 5.1.0 5.1.3 semver | Not specified |
| CNA | Stormshield | Stormshield Network Security | unaffected 4.3.45 QS semver | Not specified |
| CNA | Stormshield | Stormshield Network Security | unaffected 4.8.20 LTSB semver | Not specified |
| CNA | Stormshield | Stormshield Network Security | unaffected 5.0.10 semver | Not specified |
| CNA | Stormshield | Stormshield Network Security | unaffected 5.1.4 EA | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| advisories.stormshield.eu/2026-026 | [email protected] | advisories.stormshield.eu | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: The following updates will fix this vulnerability: * SNS 5.1.4 EA * SNS 5.0.10 * SNS 4.8.20 LSTB * SNS 4.3.45 QS
Workarounds
CNA: There is no workaround solution.
There are currently no legacy QID mappings associated with this CVE.