Lucene search

GoogleOSV:CVE-2023-26847

HistoryApr 11, 2023 - 3:15 p.m.

CVE-2023-26847

2023-04-1115:15:10

Google

osv.dev

cve-2023-26847

stored cross-site scripting

opencats

web scripts

html

crafted payload

opencats/index.php

software

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.7%

JSON

A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates.

CPENameOperatorVersion
opencatseqdelete
opencatseq0.9.6
opencatseq0.9.3-1
opencatseq0.9.3
opencatseq0.9.3-2
opencatseqopencats-0.9.7
opencatseq0.9.3-3-test-release
opencatseq0.9.3-2-test-release
opencatseq0.9.3-3
opencatseq0.9.1a

Name	Operator	Version
opencats	eq	delete
opencats	eq	0.9.6
opencats	eq	0.9.3-1
opencats	eq	0.9.3
opencats	eq	0.9.3-2
opencats	eq	opencats-0.9.7
opencats	eq	0.9.3-3-test-release
opencats	eq	0.9.3-2-test-release
opencats	eq	0.9.3-3
opencats	eq	0.9.1a

Rows per page:

1-10 of 171

References

github.com/cassis-sec/CVE/tree/main/2023/CVE-2023-26847

opencats.org