A stored XSS vulnerability in the SelfBest platform 2023.3 allows authenticated attackers to execute arbitrary scripts in the browsers of other users, posing a severe risk of session hijacking.

This is a stored cross-site scripting (XSS) flaw located in the chat message input field. Although the initial advisory implies authenticated access, the CVSS vector indicates that no special privileges are required to exploit this injection point.

Successful exploitation permits unauthorized script execution within the environment of other users, which can lead to session hijacking, account takeover, or the theft of sensitive session tokens. Given the CVSS score of 7.2, this vulnerability represents a high risk to the confidentiality and integrity of user accounts and organizational data.

Immediate Action: Contact the vendor for the latest security patches or updates to address the chat input sanitization flaw in version 2023.3.

Proactive Monitoring: Review application logs for suspicious characters or script tags within chat message submissions and monitor for unusual spikes in account access patterns.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and deploy a Web Application Firewall (WAF) to filter malicious payloads from chat input.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's write-up referenced in the CVE record.

The presence of a public proof-of-concept elevates the risk of this vulnerability. Organizations using the SelfBest platform 2023.3 should prioritize updating the software or applying vendor-provided mitigations immediately to prevent potential session hijacking and unauthorized account access.