Lucene search

MitreCVE-2023-33255

HistoryMay 26, 2023 - 8:15 p.m.

CVE-2023-33255

2023-05-2620:15:49

CWE-79

mitre

web.nvd.nist.gov

papaya viewer

dicom

nifti

image injection

javascript code

security vulnerability

cve-2023-33255

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.6

Confidence

High

EPSS

0.004

Percentile

74.8%

JSON

An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web application without any kind of sanitization. This allows injection of arbitrary JavaScript code into image metadata, which is executed when that metadata is displayed in the Papaya web application.

Affected configurations

Nvd

Node

uthscsapapaya_viewerMatch1.0

VendorProductVersionCPE
uthscsapapaya_viewer1.0cpe:2.3:a:uthscsa:papaya_viewer:1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
uthscsa	papaya_viewer	1.0	cpe:2.3:a:uthscsa:papaya_viewer:1.0:::::::*

References

packetstormsecurity.com/files/172644/Papaya-Medical-Viewer-1.0-Cross-Site-Scripting.html

seclists.org/fulldisclosure/2023/May/21

schutzwerk.com

www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001.txt

www.schutzwerk.com/blog/schutzwerk-sa-2022-001/

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.6

Confidence

High

EPSS

0.004

Percentile

74.8%

JSON

Related for CVE-2023-33255