Lucene search

GoogleOSV:CVE-2023-27293

HistoryFeb 28, 2023 - 5:15 p.m.

CVE-2023-27293

2023-02-2817:15:11

Google

osv.dev

improper input neutralization

execution of javascript

user review

malicious submission

authentication

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.4%

JSON

Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate’s submission. This could be used to steal other users’ cookies and force users to make actions without their knowledge.

CPENameOperatorVersion
opencatseqdelete
opencatseq0.9.6
opencatseq0.9.3-1
opencatseq0.9.3
opencatseq0.9.3-2
opencatseq0.9.3-3-test-release
opencatseq0.9.3-2-test-release
opencatseq0.9.3-3
opencatseq0.9.1a
opencatseqopencats-0.9.3

Name	Operator	Version
opencats	eq	delete
opencats	eq	0.9.6
opencats	eq	0.9.3-1
opencats	eq	0.9.3
opencats	eq	0.9.3-2
opencats	eq	0.9.3-3-test-release
opencats	eq	0.9.3-2-test-release
opencats	eq	0.9.3-3
opencats	eq	0.9.1a
opencats	eq	opencats-0.9.3

Rows per page:

1-10 of 161

References

www.tenable.com/security/research/tra-2023-8

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.4%

JSON

Related for OSV:CVE-2023-27293