Lucene search

INCIBEVULNRICHMENT:CVE-2023-5052

HistoryMay 13, 2024 - 6:53 a.m.

CVE-2023-5052 Cross Site Scripting (XSS) in Servidor Uniforme Zero

2024-05-1306:53:44

CWE-79

INCIBE

github.com

cve-2023-5052

cross site scripting

servidor uniforme zero

uniform server zero

remote user

session details

vulnerability

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

vulnerability in Uniform Server Zero, version 10.2.5, consisting of an XSS through the /us_extra/phpinfo.php page. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and partially take over their session details.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Uniform Server Zero",
    "vendor": "Uniform Server Zero",
    "versions": [
      {
        "status": "affected",
        "version": "10.2.5"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-uniform-server-zero