CVE-2023-0357

2023-04-0400:00:00

Fluid Attacks

www.cve.org

helpy version 2.8.0

unauthenticated

remote attacker

xss exploit

attachments validation

0.003 Low

EPSS

Percentile

68.6%

JSON

Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. This is possible because the application does not correctly validate the attachments sent by customers in the ticket.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Helpy",
    "versions": [
      {
        "version": "2.8.0",
        "status": "affected"
      }
    ]
  }
]

References

fluidattacks.com/advisories/quayle/

github.com/helpyio/helpy/

0.003 Low

EPSS

Percentile

68.6%

JSON

Related for CVELIST:CVE-2023-0357