CVE-2023-4090

Published Oct 4, 2023

Last updated a year ago

CVSS medium 6.1

Overview

Description: Cross-site Scripting (XSS) reflected vulnerability on WideStand until 5.3.5 version, which generates one of the meta tags directly using the content of the queried URL, which would allow an attacker to inject HTML/Javascript code into the response.
Source: cve-coordination@incibe.es
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-79
cve-coordination@incibe.es: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:acilia:widestand:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D33BB426-ABC2-4B03-BEC8-FA1891234F12",
            "versionEndIncluding": "5.3.5"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References