CVE-2023-38883

2023-11-2019:15:08

Google

osv.dev

cve-2023-38883

cross-site scripting

remote attackers

arbitrary javascript

web browser security

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.3%

JSON

A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED’s openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the ‘ajax’ parameter in ‘ParentLookup.php’.

CPENameOperatorVersion
opensis-responsive-designeqV9.0
opensis-responsive-designeq7.1
opensis-responsive-designeqV7.5
opensis-responsive-designeqer7.4
opensis-responsive-designeq7.2
opensis-responsive-designeq7.3
opensis-responsive-designeqV8.0
opensis-responsive-designeqVer7.0beta1
opensis-responsive-designeqVer7.0Prod_update
opensis-responsive-designeqer7.1

Name	Operator	Version
opensis-responsive-design	eq	V9.0
opensis-responsive-design	eq	7.1
opensis-responsive-design	eq	V7.5
opensis-responsive-design	eq	er7.4
opensis-responsive-design	eq	7.2
opensis-responsive-design	eq	7.3
opensis-responsive-design	eq	V8.0
opensis-responsive-design	eq	Ver7.0beta1
opensis-responsive-design	eq	Ver7.0Prod_update
opensis-responsive-design	eq	er7.1