Lucene search

Veracode Vulnerability DatabaseVERACODE:46806

HistoryMay 08, 2024 - 7:43 a.m.

Cross-site Scripting (XSS)

2024-05-0807:43:23

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

ms basic

cross-site scripting

input sanitization

search function

malicious scripts

arbitrary code

execution

browsers

4.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

MS Basic vulnerable to a cross-site scripting (XSS) vulnerability. The vulnerability is due to insufficient input sanitization in the search function, allowing attackers to inject malicious scripts into the search input, potentially leading to the execution of arbitrary code in the context of other users’ browsers.

CPENameOperatorVersion
ms-basicle2.2.2
ms-basicle2.2.2

CPE	Name	Operator	Version
	ms-basic	le	2.2.2
	ms-basic	le	2.2.2

References

github.com/advisories/GHSA-64cm-3cj3-67hf

github.com/Fr1ezy/Fr1ezy-ms-basic_XSS

mvnrepository.com/artifact/net.mingsoft/ms-basic

4.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for VERACODE:46806