Lucene search

[email protected]CVE-2023-31506

HistoryFeb 09, 2024 - 7:15 a.m.

CVE-2023-31506

2024-02-0907:15:59

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-31506

xss

grav

security vulnerability

web scripting

html

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.1%

JSON

A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element.

Affected configurations

NVD

Node

getgravgravRange≤1.7.44

CPENameOperatorVersion
getgrav:gravgetgrav gravle1.7.44

CPE	Name	Operator	Version
getgrav:grav	getgrav grav	le	1.7.44

References

m3n0sd0n4ld.github.io/patoHackventuras/cve-2023-31506