Lucene search

[email protected]CVE-2023-5052

HistoryMay 14, 2024 - 2:23 p.m.

CVE-2023-5052

2024-05-1414:23:51

CWE-79

[email protected]

web.nvd.nist.gov

vulnerability

uniform server zero

xss

phpinfo.php

remote user

authenticated user

session details

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

5.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.8%

JSON

vulnerability in Uniform Server Zero, version 10.2.5, consisting of an XSS through the /us_extra/phpinfo.php page. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and partially take over their session details.

Affected configurations

Vulners

Node

uniform_server_zerouniform_server_zeroRange≤10.2.5

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Uniform Server Zero",
    "vendor": "Uniform Server Zero",
    "versions": [
      {
        "status": "affected",
        "version": "10.2.5"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-uniform-server-zero