Lucene search

[email protected]NVD:CVE-2023-26042

HistoryFeb 27, 2023 - 3:15 p.m.

CVE-2023-26042

2023-02-2715:15:11

CWE-79

[email protected]

web.nvd.nist.gov

part-db

inventory management

cve-2023-26042

content-security-policy

pat-db 1.0.2

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.1%

JSON

Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later.

Affected configurations

Nvd

Node

part-db_projectpart-dbRange1.0.0–1.0.2

VendorProductVersionCPE
part-db_projectpart-db*cpe:2.3:a:part-db_project:part-db:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
part-db_project	part-db	*	cpe:2.3:a:part-db_project:part-db::::::::

References

github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099

github.com/Part-DB/Part-DB-server/pull/227

github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2

github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.1%

JSON

Related for NVD:CVE-2023-26042

osv1 prion1 cvelist1 cve1