TI-2023-11451 Aliases CVE-2023-26291 GHSA-fmgc-gfhr-4q47

Cross-site scripting in Forcepoint Cloud Security Gateway

LOW 27CWE-79Published 2023-03-29 · Updated 2025-02-12

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_form.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_form.mhtml modules) allows Reflected XSS.This issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00353 29th percentileScored 2026-11-07

Fix Fixed Cloud Security Gateway (CSG) (Forcepoint): 03/29/2023Web Security (Forcepoint): 03/29/2023

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Forcepoint	Cloud Security Gateway (CSG)	before 03/29/2023	03/29/2023	Patch available	CNA
Forcepoint	Web Security	before 03/29/2023	03/29/2023	Patch available	CNA

Cloud Security Gateway (CSG) VendorForcepoint Affected before 03/29/2023 Fixed in 03/29/2023 Patch available CNA
Web Security VendorForcepoint Affected before 03/29/2023 Fixed in 03/29/2023 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:forcepoint:cloud_security_gateway::::::::	before 2023-03-29	Vulnerable	Forcepoint
cpe:2.3:a:forcepoint:web_security::::::::	before 2023-03-29	Vulnerable	Forcepoint

cpe:2.3:a:forcepoint:cloud_security_gateway:*:*:*:*:*:*:*:* Versions before 2023-03-29 Vulnerable ·Forcepoint
cpe:2.3:a:forcepoint:web_security:*:*:*:*:*:*:*:* Versions before 2023-03-29 Vulnerable ·Forcepoint

Remediation

Fix · CNA Cloud Security Gateway (CSG) (Forcepoint) Fixed in 03/29/2023
Fix · CNA Web Security (Forcepoint) Fixed in 03/29/2023

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-03-29
Forcepoint Cloud Security Gateway (CSG), Web Security 03/29/2023
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2023-11452 Cross-site scripting in Forcepoint Cloud Security GatewayPriority LOW 27
- TI-2023-11450 Cross-site scripting in Forcepoint Cloud Security GatewayPriority LOW 27
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-26291
2026-10-03 Alias added: GHSA-fmgc-gfhr-4q47

References

Advisory 1

https://support.forcepoint.com/s/article/000041617

TI-2022-01566 XML external entity injection in Forcepoint Data Loss Prevention CVSS 3.1CRITICAL 9.8
TI-2023-11452 Cross-site scripting in Forcepoint Cloud Security Gateway CVSS 3.1MEDIUM 6.1
TI-2023-11450 Cross-site scripting in Forcepoint Cloud Security Gateway CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences