Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Kiteworks Secure Data Forms contains a reflected XSS vulnerability that allows attackers to trick users into executing malicious JavaScript code by sending specially crafted links. This could lead to theft of sensitive data or unauthorized actions on behalf of the user.

A reflected XSS vulnerability in Kiteworks Secure Data Forms (pre-9.3.0) allows external attackers to inject arbitrary JavaScript into user browsers via malicious URLs. The attack vector is social engineering (phishing/link manipulation), requiring user interaction to visit the crafted link; successful exploitation enables arbitrary script execution in the victim's session context with access to session data and form contents.