CVE-2015-3443

Thycotic Secret Server <8.8.000005 - XSS

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-3443. PoCs published by Marco Delai.

AI-analyzed exploit summary This advisory describes a stored XSS vulnerability in Thycotic Secret Server versions 8.6.000000 to 8.8.000004, where a malicious script embedded in a password entry executes when toggled in the basic dashboard view.

Description

Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or HTML via a password entry, which is not properly handled when toggling the password mask.

Exploits (1)

exploitdb WRITEUP
by Marco Delai · textwebappsmultiple
https://www.exploit-db.com/exploits/37394

This advisory describes a stored XSS vulnerability in Thycotic Secret Server versions 8.6.000000 to 8.8.000004, where a malicious script embedded in a password entry executes when toggled in the basic dashboard view.

Classification
Writeup 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Thycotic Secret Server 8.6.000000 to 8.8.000004
Auth required
Prerequisites: Valid user credentials to create a password entry
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/535821/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/75393
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/37394/
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2015/Jun/78

Scores

EPSS 0.0202
EPSS Percentile 78.5%

Details

CWE
CWE-79
Status published
Products (7)
thycotic/secret_server 8.6.000000
thycotic/secret_server 8.6.000009
thycotic/secret_server 8.6.000010
thycotic/secret_server 8.7.000000
thycotic/secret_server 8.8.000000
thycotic/secret_server 8.8.000001
thycotic/secret_server 8.8.000004
Published Jul 02, 2015
Tracked Since Feb 18, 2026