Cross Site Scripting

2023-10-2008:35:24

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

archivebox

cross site scripting

vulnerability

javascript

admin

attacker

action

software

CVSS3

6.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

20.8%

JSON

archivebox is vulnerable to Cross Site Scripting. The vulnerability is due to wget extractor in ArchiveBox, which allows malicious JavaScript in archived pages to execute and act as an admin, especially when the user viewed the pages during a browser session in which logged into the ArchiveBox admin. This could potentially allows an attacker to perform any action typically reserved for admin users.