Lucene search

GoogleOSV:CVE-2023-52264

HistoryDec 30, 2023 - 11:15 p.m.

CVE-2023-52264

2023-12-3023:15:42

Google

osv.dev

beesblog

reflected xss

mishandled sharing_url

controllers/front/post.php

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.

CPENameOperatorVersion
beesblogeq1.6.1
beesblogeq1.0.4
beesblogeq1.6.0
beesblogeq1.0.1
beesblogeq1.3.0
beesblogeq1.5.1
beesblogeq1.5.2
beesblogeq1.2.0
beesblogeq1.5.3
beesblogeq1.5.0

Name	Operator	Version
beesblog	eq	1.6.1
beesblog	eq	1.0.4
beesblog	eq	1.6.0
beesblog	eq	1.0.1
beesblog	eq	1.3.0
beesblog	eq	1.5.1
beesblog	eq	1.5.2
beesblog	eq	1.2.0
beesblog	eq	1.5.3
beesblog	eq	1.5.0

Rows per page:

1-10 of 161

References

github.com/thirtybees/beesblog/commit/a3aeed8fcf01c8e4112c168cf2ef7d67c8056daf

github.com/thirtybees/beesblog/compare/1.6.1...1.6.2

zigrin.com/advisories/thirty-bees-reflected-cross-site-scripting-vulnerability/

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

Related for OSV:CVE-2023-52264