Lucene search

MitreCVE-2023-48199

HistoryNov 15, 2023 - 11:15 p.m.

CVE-2023-48199

2023-11-1523:15:09

CWE-74

mitre

web.nvd.nist.gov

cve-2023-48199

grocy

security issue

local attacker

arbitrary code execution

sensitive information disclosure

qr code

manageapikeys

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.2%

JSON

HTML Injection vulnerability in the ‘manageApiKeys’ component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker can then manipulate page content in the QR code detail popup, often coupled with social engineering tactics, exploiting both the trust of users and the application’s lack of proper input handling.

Affected configurations

Nvd

Node

grocy_projectgrocyMatch4.0.3

VendorProductVersionCPE
grocy_projectgrocy4.0.3cpe:2.3:a:grocy_project:grocy:4.0.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
grocy_project	grocy	4.0.3	cpe:2.3:a:grocy_project:grocy:4.0.3:::::::*

References

github.com/grocy/grocy

grocy.info

nitipoom-jar.github.io/CVE-2023-48199/

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.2%

JSON

Related for CVE-2023-48199