CVE-2023-42436

Published Dec 26, 2023

Last updated 10 months ago

CVSS medium 5.4

Overview

Description: Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Source: vultures@jpcert.or.jp
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.4
Impact score: 2.7
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:weseek:growi:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D901AB34-3DCE-4839-80CD-3FEC49A4A54D",
            "versionEndExcluding": "3.4.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References