CVE-2023-5901

2023-11-0704:24:31

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023

cross-site scripting

github

pkp/pkp-lib

nvd

security vulnerability

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

14.2%

JSON

Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

Affected configurations

NVD

Node

sfupkp_web_application_libraryRange<3.3.0-16

CPENameOperatorVersion
sfu:pkp_web_application_librarysfu pkp web application librarylt3.3.0-16

CPE	Name	Operator	Version
sfu:pkp_web_application_library	sfu pkp web application library	lt	3.3.0-16

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "pkp/pkp-lib",
    "vendor": "pkp",
    "versions": [
      {
        "lessThan": "3.3.0-16",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]