Lucene search

K
cveJpcertCVE-2023-47175
HistoryNov 20, 2023 - 5:15 a.m.

CVE-2023-47175

2023-11-2005:15:08
CWE-79
jpcert
web.nvd.nist.gov
19
cve-2023-47175
cross-site scripting
luxcal web calendar
mysql
sqlite
security vulnerability

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

51.2%

Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the product.

Affected configurations

Nvd
Node
luxsoftluxcal_web_calendarRange<5.2.4lsqlite
OR
luxsoftluxcal_web_calendarRange<5.2.4mmysql
VendorProductVersionCPE
luxsoftluxcal_web_calendar*cpe:2.3:a:luxsoft:luxcal_web_calendar:*:*:*:*:sqlite:*:*:*
luxsoftluxcal_web_calendar*cpe:2.3:a:luxsoft:luxcal_web_calendar:*:*:*:*:mysql:*:*:*

CNA Affected

[
  {
    "vendor": "LuxSoft",
    "product": "LuxCal Web Calendar",
    "versions": [
      {
        "version": "prior to 5.2.4M (MySQL version)",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "LuxSoft",
    "product": "LuxCal Web Calendar",
    "versions": [
      {
        "version": "prior to 5.2.4L (SQLite version)",
        "status": "affected"
      }
    ]
  }
]

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

51.2%

Related for CVE-2023-47175