CVE-2023-38878

2023-09-1122:15:08

Google

osv.dev

vulnerability

cross-site scripting

remote attacker

execution

javascript

injection

payload

parameters

web browser

malicious

oauth2.

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.3%

JSON

A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious payload into the ‘error’ and ‘error_description’ parameters of ‘oauth2.php’.

CPENameOperatorVersion
openstamanagereq2.4.38
openstamanagereq2.4.35
openstamanagereq2.4.40
openstamanagereq2.4.30
openstamanagereq2.4.45
openstamanagereq2.4.25
openstamanagereq2.4.32
openstamanagereq2.4.36
openstamanagereq2.4.42
openstamanagereq2.4.46

Name	Operator	Version
openstamanager	eq	2.4.38
openstamanager	eq	2.4.35
openstamanager	eq	2.4.40
openstamanager	eq	2.4.30
openstamanager	eq	2.4.45
openstamanager	eq	2.4.25
openstamanager	eq	2.4.32
openstamanager	eq	2.4.36
openstamanager	eq	2.4.42
openstamanager	eq	2.4.46