Lucene search

MitreCVE-2023-25241

HistoryFeb 13, 2023 - 9:15 p.m.

CVE-2023-25241

2023-02-1321:15:15

CWE-79

mitre

web.nvd.nist.gov

cve-2023-25241

bgerp

v22.31

reflected xss

search parameter

nvd

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

30.8%

JSON

bgERP v22.31 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.

Affected configurations

Nvd

Node

bgerpbgerpMatch22.31

VendorProductVersionCPE
bgerpbgerp22.31cpe:2.3:a:bgerp:bgerp:22.31:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bgerp	bgerp	22.31	cpe:2.3:a:bgerp:bgerp:22.31:::::::*

References

github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/bgERP/2023/bgERP-v22.31-Cookie-Session-vulnerability%2BXSS-Reflected

portswigger.net/kb/issues/00500b01_cookie-manipulation-reflected-dom-based

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

30.8%

JSON

Related for CVE-2023-25241