Lucene search

GoogleOSV:CVE-2023-37623

HistoryJul 26, 2023 - 8:15 p.m.

CVE-2023-37623

2023-07-2620:15:12

Google

osv.dev

netdisco

cross-site scripting

vulnerability

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.1%

JSON

Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm.

CPENameOperatorVersion
netdiscoeq2.021000
netdiscoeq2.035003
netdiscoeq2.032005
netdiscoeq2.050003
netdiscoeq2.038028.003
netdiscoeq2.039028
netdiscoeq2.028000
netdiscoeq2.038002_001
netdiscoeq2.045006
netdiscoeq2.011000

Name	Operator	Version
netdisco	eq	2.021000
netdisco	eq	2.035003
netdisco	eq	2.032005
netdisco	eq	2.050003
netdisco	eq	2.038028.003
netdisco	eq	2.039028
netdisco	eq	2.028000
netdisco	eq	2.038002_001
netdisco	eq	2.045006
netdisco	eq	2.011000

Rows per page:

1-10 of 4231

References

github.com/benjaminpsinclair/Netdisco-2023-Advisory

github.com/benjaminpsinclair/Netdisco-CVE

github.com/netdisco/netdisco/commit/39562e0633a2472d50f7f33e69c36da4ad1fbfa3

github.com/netdisco/netdisco/commit/9f4401f2fb00c84210cd551b97c8ad60e78c71e0