CVE-2023-29014

2023-04-0620:15:08

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-29014

goobi viewer

web application

digitised material

cross-site scripting

logid parameter

security vulnerability

malicious script code

nvd

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

32.4%

JSON

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user’s browser. The vulnerability has been fixed in version 23.03.

Affected configurations

Vulners

NVD

Node

intrandagoobi_viewer_coreRange<23.03

VendorProductVersionCPE
intrandagoobi_viewer_core*cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
intranda	goobi_viewer_core	*	cpe:2.3:a:intranda:goobi_viewer_core::::::::

CNA Affected

[
  {
    "vendor": "intranda",
    "product": "goobi-viewer-core",
    "versions": [
      {
        "version": "< 23.03",
        "status": "affected"
      }
    ]
  }
]