Lucene search

[email protected]CVE-2023-27293

HistoryFeb 28, 2023 - 5:15 p.m.

CVE-2023-27293

2023-02-2817:15:11

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-27293

web page generation

input neutralization

malicious javascript

cookie theft

unauthorized actions

nvd

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

50.3%

JSON

Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate’s submission. This could be used to steal other users’ cookies and force users to make actions without their knowledge.

Affected configurations

NVD

Node

opencatsopencatsMatch0.9.6

VendorProductVersionCPE
opencatsopencats0.9.6cpe:/a:opencats:opencats:0.9.6:::

Vendor	Product	Version	CPE
opencats	opencats	0.9.6	cpe:/a:opencats:opencats:0.9.6:::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "OpenCATS",
    "versions": [
      {
        "version": "0.9.6",
        "status": "affected"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2023-8

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

50.3%

JSON

Related for CVE-2023-27293

prion1 nvd1 osv1 cvelist1