Lucene search

[email protected]NVD:CVE-2023-38911

HistoryAug 18, 2023 - 7:15 p.m.

CVE-2023-38911

2023-08-1819:15:13

CWE-79

[email protected]

web.nvd.nist.gov

cross-site scripting

csz cms

arbitrary code execution

youtube url

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

27.1%

JSON

A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouTube URL fields.

Affected configurations

Nvd

Node

cszcmscsz_cmsMatch1.3.0

VendorProductVersionCPE
cszcmscsz_cms1.3.0cpe:2.3:a:cszcms:csz_cms:1.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cszcms	csz_cms	1.3.0	cpe:2.3:a:cszcms:csz_cms:1.3.0:::::::*

References

github.com/desencrypt/CVE/blob/main/CVE-2023-38911/Readme.md