GitHub Advisory DatabaseGHSA-2R9R-8FCG-M38GGoobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
40.4%
Impact
A cross-site scripting vulnerability has been identified in Goobi viewer core when using nicknames. An attacker could create a user account and enter malicious scripts into their profile’s nickname, resulting in the execution in the user’s browser when displaying the nickname on certain pages.
Patches
The vulnerability has been fixed in version 23.03
If you have any questions or comments about this advisory:
- Email us at [email protected]
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| io.goobi.viewer | viewer-core | * | cpe:2.3:a:io.goobi.viewer:viewer-core:*:*:*:*:*:*:*:* |
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
40.4%