CVE-2021-36450

What it actually does

Verint Workforce Optimization 15.2.8.10048 contains a cross-site scripting vulnerability in the control/my_notifications endpoint through the NEWUINAV parameter. Because user-supplied input is reflected or rendered without sufficient output encoding or sanitization, an attacker can cause arbitrary JavaScript to execute in the browser of a user who follows a crafted link or otherwise loads attacker-controlled content. The CVSS vector indicates network exploitability, low attack complexity, no attacker authentication required, required user interaction, and changed scope, meaning the injected script can affect the victim user's browser session and potentially access or modify data available to that user within the application context.

Why it matters to the business

Successful exploitation can allow an attacker to abuse trusted Verint Workforce Optimization sessions, steal session-related data if not properly protected, perform actions as the victim, alter displayed content, or redirect users to credential-harvesting pages. The direct availability impact is limited, but confidentiality and integrity of user-facing application workflows may be affected. The EPSS score is elevated and exploit maturity is listed as weaponized, so internet-exposed or broadly accessible deployments should be treated as higher priority even though the issue is not currently listed in CISA KEV and is not known from the provided data to be used in ransomware campaigns.

How an attack unfolds

An attacker crafts a URL targeting the Verint Workforce Optimization control/my_notifications page and places malicious JavaScript in the NEWUINAV parameter. The attacker then convinces a legitimate user to open the link, for example through phishing, a chat message, a ticket, or another trusted communication channel. When the victim's browser requests the vulnerable page, the application includes the attacker-controlled parameter value in the rendered response without adequate encoding. The browser executes the injected script in the security context of the Verint Workforce Optimization application. From there, the script may read page content available to the victim, initiate application actions as the victim, modify the user interface, redirect the user to a fake login page, or attempt to exfiltrate accessible tokens or sensitive data depending on browser controls, cookie attributes, Content Security Policy, and application design.

How to fix it

Upgrade Verint Workforce Optimization to a vendor-supported release that remediates this issue. No fixed version was provided in the input, so organizations should consult Verint advisories, support channels, or release notes for the applicable patched version for their deployment branch. If immediate upgrade is not possible, reduce exposure by restricting access to trusted networks or VPN, enforcing strong authentication, deploying a web application firewall rule to block suspicious NEWUINAV values, and validating that all user-controlled data rendered by the application is contextually output-encoded. Defense-in-depth controls should include HttpOnly and Secure cookie attributes, SameSite protections where compatible, and a restrictive Content Security Policy to reduce the impact of injected scripts.

How to confirm the fix worked

Confirm the deployed Verint Workforce Optimization version is newer than the affected build or is confirmed patched by the vendor. Test the control/my_notifications endpoint with a harmless XSS probe in the NEWUINAV parameter and verify the payload is encoded or rejected rather than executed. Review HTTP responses to ensure user input is not reflected into HTML, JavaScript, attributes, or URLs without proper encoding. Validate that compensating controls such as WAF rules, access restrictions, and Content Security Policy are active and effective. For internet-facing systems, perform authenticated and unauthenticated web application scans focused on reflected XSS in the NEWUINAV parameter.

Typical attack path

1. Identify an accessible Verint Workforce Optimization deployment running an affected version such as 15.2.8.10048.
2. Craft a malicious request to /control/my_notifications with JavaScript embedded in the NEWUINAV parameter.
3. Deliver the crafted URL to a target user through phishing, messaging, support workflows, or another social-engineering channel.
4. Wait for the victim to open the link while authenticated or otherwise trusted by the application.
5. Have the victim's browser execute attacker-supplied JavaScript in the Verint Workforce Optimization application context.
6. Use the script to read accessible page data, perform actions as the victim, alter content, redirect the victim, or exfiltrate available information.

How to detect it

Review web server, reverse proxy, WAF, load balancer, and application access logs for requests to /control/my_notifications where the query string contains NEWUINAV with script-like content, encoded HTML tags, JavaScript URI schemes, event-handler attributes, or external domains. Pay special attention to requests followed by unusual redirects, authentication prompts, abnormal user actions, or outbound connections from user browsers to unfamiliar domains. Proxy and secure web gateway logs may show victims navigating to crafted URLs or subsequently contacting attacker-controlled collection endpoints. WAF logs may contain blocked or alerted XSS signatures involving NEWUINAV. Browser telemetry or EDR can help identify suspicious script-driven redirects, clipboard access, credential phishing pages, or anomalous child browser processes, though exploitation usually occurs inside the browser and may leave limited host artifacts. If exploitation is suspected, correlate timestamps of suspicious NEWUINAV requests with user session activity, authentication events, application changes, and outbound web traffic from affected users.

• /control/my_notifications
• NEWUINAV=
• /control/my_notifications?NEWUINAV=
• NEWUINAV=%3Cscript
• NEWUINAV=<script
• NEWUINAV=%3C%2Fscript%3E
• NEWUINAV=javascript:
• NEWUINAV=javascript%3A
• NEWUINAV=%22%3E%3Cscript
• NEWUINAV='><script
• NEWUINAV=%27%3E%3Cscript
• NEWUINAV=%3Cimg
• NEWUINAV=<img
• NEWUINAV=%3Csvg
• NEWUINAV=<svg
• NEWUINAV=onerror
• NEWUINAV=onload
• NEWUINAV=%20onerror%3D
• NEWUINAV=%20onload%3D
• NEWUINAV=alert(
• NEWUINAV=confirm(
• NEWUINAV=prompt(
• NEWUINAV=document.cookie
• NEWUINAV=eval(
• NEWUINAV=fetch(
• NEWUINAV=XMLHttpRequest

What your security team should do

• Prioritize remediation for externally accessible Verint Workforce Optimization deployments because exploit maturity is weaponized and EPSS likelihood is elevated.
• Inventory Verint Workforce Optimization instances and identify deployments running version 15.2.8.10048 or otherwise confirmed vulnerable builds.
• Open a vendor support case or review Verint release notes to identify the appropriate fixed version, then upgrade to a supported patched release.
• Until patched, restrict access to the application to trusted networks and implement WAF filtering for malicious NEWUINAV parameter values.
• Harden session protections with HttpOnly, Secure, and SameSite cookie settings where supported, and deploy a restrictive Content Security Policy to limit script execution and data exfiltration.
• Search web, proxy, WAF, EDR, and identity logs for suspicious requests to /control/my_notifications containing script-like NEWUINAV payloads.
• Educate help desk and business users to report unexpected Verint Workforce Optimization links, redirects, or login prompts.