CVE-2023-7238

Published Jan 23, 2024

Last updated 10 months ago

CVSS medium 6.1

Overview

Description: A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.
Source: ics-cert@hq.dhs.gov
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-79
ics-cert@hq.dhs.gov: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:orthanc-server:osimis_web_viewer:1.4.2.0-9d9eff4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6B8E6B02-A66D-4084-A9C5-CAC7758A7F84"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References