CVE-2023-29015

2023-04-0620:15:08

CWE-79

[email protected]

web.nvd.nist.gov

goobi viewer

web application

digitised material

cross-site scripting

xss vulnerability

security patch

nvd

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

35.6%

JSON

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user’s browser when displaying the comment. The vulnerability has been fixed in version 23.03.

Affected configurations

Vulners

NVD

Node

intrandagoobi_viewer_coreRange<23.03

VendorProductVersionCPE
intrandagoobi_viewer_core*cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
intranda	goobi_viewer_core	*	cpe:2.3:a:intranda:goobi_viewer_core::::::::

CNA Affected

[
  {
    "vendor": "intranda",
    "product": "goobi-viewer-core",
    "versions": [
      {
        "version": "< 23.03",
        "status": "affected"
      }
    ]
  }
]