Lucene search

[email protected]NVD:CVE-2023-45471

HistoryOct 20, 2023 - 4:15 a.m.

CVE-2023-45471

2023-10-2004:15:10

CWE-79

[email protected]

web.nvd.nist.gov

qad search server

stored cross-site scripting

xss

insufficient checks

unauthenticated attackers

malicious web script

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

31.8%

JSON

The QAD Search Server is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to, and including, 1.0.0.315 due to insufficient checks on indexes. This makes it possible for unauthenticated attackers to create a new index and inject a malicious web script into its name, that will execute whenever a user accesses the search page.

Affected configurations

Nvd

Node

qadsearch_serverRange<1.0.0.315

VendorProductVersionCPE
qadsearch_server*cpe:2.3:a:qad:search_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qad	search_server	*	cpe:2.3:a:qad:search_server::::::::

References

github.com/itsAptx/CVE-2023-45471