deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-51470
Published: 2023-12-29
Description: Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.11.1.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/rencontre/wordpress-rencontre-plugin-3-11-1-authenticated-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rencontre/wordpress-rencontre-plugin-3-11-1-authenticated-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-51505
Published: 2023-12-29
Description: Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store : from n/a through 1.0.6.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://patchstack.com/database/vulnerability/profit-products-tables-for-woocommerce/wordpress-active-products-tables-for-woocommerce-plugin-1-0-6-unauthenticated-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profit-products-tables-for-woocommerce/wordpress-active-products-tables-for-woocommerce-plugin-1-0-6-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-51545
Published: 2023-12-29
Description: Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a through 1.4.4.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352, CWE-502
References: https://patchstack.com/database/vulnerability/job-manager-career/wordpress-job-manager-career-plugin-1-4-4-cross-site-request-forgery-csrf-to-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/job-manager-career/wordpress-job-manager-career-plugin-1-4-4-cross-site-request-forgery-csrf-to-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-51676
Published: 2023-12-29
Description: Server-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor.This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/happy-elementor-addons/wordpress-happy-addons-for-elementor-plugin-3-9-1-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/happy-elementor-addons/wordpress-happy-addons-for-elementor-plugin-3-9-1-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2023-7113
Published: 2023-12-29
Description: Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.


CVSS Score: 3.7 (LOW)
CWE: CWE-79, CWE-79
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-7114
Published: 2023-12-29
Description: Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.


CVSS Score: 7.1 (HIGH)
CWE: CWE-74, CWE-22
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-51410
Published: 2023-12-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log.This issue affects WP Mail Log: from n/a through 1.1.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/wp-mail-log/wordpress-wp-mail-log-plugin-1-1-2-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-mail-log/wordpress-wp-mail-log-plugin-1-1-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-51411
Published: 2023-12-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/acf-frontend-form-element/wordpress-frontend-admin-by-dynamiapps-plugin-3-18-3-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/acf-frontend-form-element/wordpress-frontend-admin-by-dynamiapps-plugin-3-18-3-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-51412
Published: 2023-12-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.25.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/piotnetforms/wordpress-piotnetforms-plugin-1-0-25-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/piotnetforms/wordpress-piotnetforms-plugin-1-0-25-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-51417
Published: 2023-12-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/jvm-rich-text-icons/wordpress-jvm-rich-text-icons-plugin-1-2-3-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jvm-rich-text-icons/wordpress-jvm-rich-text-icons-plugin-1-2-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-51419
Published: 2023-12-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome.This issue affects BERTHA AI. Your AI co-pilot for WordPress and Chrome: from n/a through 1.11.10.7.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://patchstack.com/database/vulnerability/bertha-ai-free/wordpress-bertha-ai-plugin-1-11-10-7-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bertha-ai-free/wordpress-bertha-ai-plugin-1-11-10-7-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-51421
Published: 2023-12-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/verge3d/wordpress-verge3d-plugin-4-5-2-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/verge3d/wordpress-verge3d-plugin-4-5-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-51468
Published: 2023-12-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.10.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/rencontre/wordpress-rencontre-plugin-3-10-1-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rencontre/wordpress-rencontre-plugin-3-10-1-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-51473
Published: 2023-12-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin.This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/terraclassifieds/wordpress-terraclassifieds-plugin-2-0-3-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/terraclassifieds/wordpress-terraclassifieds-plugin-2-0-3-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-51475
Published: 2023-12-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in IOSS WP MLM SOFTWARE PLUGIN.This issue affects WP MLM SOFTWARE PLUGIN: from n/a through 4.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/wp-mlm/wordpress-wp-mlm-unilevel-plugin-4-0-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-mlm/wordpress-wp-mlm-unilevel-plugin-4-0-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-51675
Published: 2023-12-29
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/advanced-access-manager/wordpress-advanced-access-manager-plugin-6-9-18-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-access-manager/wordpress-advanced-access-manager-plugin-6-9-18-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2023-47804
Published: 2023-12-29
Description: Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose.

Links can be activated by clicks, or by automatic document events.

The execution of such links must be subject to user approval.

In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution.

This is a corner case of CVE-2022-47502.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-88, CWE-88
References: http://www.openwall.com/lists/oss-security/2024/01/03/3; https://lists.apache.org/thread/ygp59swfcy6g46jf8v9s6qpwmxn8fsvb; https://www.openoffice.org/security/cves/CVE-2023-47804.html
CVE: CVE-2023-4541
Published: 2023-12-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ween Software Admin Panel allows SQL Injection.This issue affects Admin Panel: through 20231229. 

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0740; https://www.usom.gov.tr/bildirim/tr-23-0740
CVE: CVE-2023-4674
Published: 2023-12-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yaztek Software Technologies and Computer Systems E-Commerce Software allows SQL Injection.This issue affects E-Commerce Software: through 20231229. 

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0741; https://www.usom.gov.tr/bildirim/tr-23-0741
CVE: CVE-2023-4675
Published: 2023-12-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GM Information Technologies MDO allows SQL Injection.This issue affects MDO: through 20231229. 

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0742; https://www.usom.gov.tr/bildirim/tr-23-0742
CVE: CVE-2023-50570
Published: 2023-12-29
Description: An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop. This is disputed because an infinite loop occurs only for cases in which the developer supplies invalid arguments. The product is not intended to always halt for contrived inputs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/seancfoley/IPAddress/issues/118; https://github.com/seancfoley/IPAddress/issues/118
CVE: CVE-2023-50571
Published: 2023-12-29
Description: easy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule.
CVSS Score: 7.8 (HIGH)
References: https://github.com/j-easy/easy-rules/issues/419; https://github.com/j-easy/easy-rules/issues/419
CVE: CVE-2023-50572
Published: 2023-12-29
Description: An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/jline/jline3/issues/909; https://github.com/jline/jline3/issues/909
CVE: CVE-2023-51517
Published: 2023-12-29
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.This issue affects Calculated Fields Form: from n/a through 1.2.28.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/calculated-fields-form/wordpress-calculated-fields-form-plugin-1-2-28-open-redirection-via-shortcode-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/calculated-fields-form/wordpress-calculated-fields-form-plugin-1-2-28-open-redirection-via-shortcode-vulnerability?_s_id=cve
CVE: CVE-2023-51527
Published: 2023-12-29
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/gpt3-ai-content-generator/wordpress-ai-power-complete-ai-pack-powered-by-gpt-4-plugin-1-8-2-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gpt3-ai-content-generator/wordpress-ai-power-complete-ai-pack-powered-by-gpt-4-plugin-1-8-2-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2023-51687
Published: 2023-12-29
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple.This issue affects Product Catalog Simple: from n/a through 1.7.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/post-type-x/wordpress-product-catalog-simple-plugin-1-7-6-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/post-type-x/wordpress-product-catalog-simple-plugin-1-7-6-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2023-51688
Published: 2023-12-29
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This issue affects eCommerce Product Catalog Plugin for WordPress: from n/a through 3.3.26.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/ecommerce-product-catalog/wordpress-ecommerce-product-catalog-plugin-for-wordpress-plugin-3-3-26-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ecommerce-product-catalog/wordpress-ecommerce-product-catalog-plugin-for-wordpress-plugin-3-3-26-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2020-17163
Published: 2023-12-29
Description: Visual Studio Code Python Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17163; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17163
CVE: CVE-2023-51663
Published: 2023-12-29
Description: Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect (OIDC) email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change their email address, they could create accounts and use resources in clusters that they should not have access to. For example, a user could create a Microsoft or Google account and then change their email to `test@example.org`. This account can then be used to create a Hail Batch account in Hail Batch clusters whose organization domain is `example.org`. The attacker is not able to access private data or impersonate another user, but they would have the ability to run jobs if Hail Batch billing projects are enabled and create Azure Tenants if they have Azure Active Directory Administrator access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-289
References: https://github.com/hail-is/hail/security/advisories/GHSA-487p-qx68-5vjw; https://github.com/hail-is/hail/security/advisories/GHSA-487p-qx68-5vjw
CVE: CVE-2023-52137
Published: 2023-12-29
Description: The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The [`verify-changed-files`](https://github.com/tj-actions/verify-changed-files) workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as `;` which can be used by an attacker to take over the [GitHub Runner](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners) if the output value is used in a raw fashion (thus being directly replaced before execution) inside a `run` block. By running custom commands, an attacker may be able to steal secrets such as `GITHUB_TOKEN` if triggered on other events than `pull_request`.

This has been patched in versions [17](https://github.com/tj-actions/verify-changed-files/releases/tag/v17) and [17.0.0](https://github.com/tj-actions/verify-changed-files/releases/tag/v17.0.0) by enabling `safe_output` by default and returning filename paths escaping special characters for bash environments.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-77
References: https://github.com/tj-actions/verify-changed-files/commit/498d3f316f501aa72485060e8c96fde7b2014f12; https://github.com/tj-actions/verify-changed-files/commit/592e305da041c09a009afa4a43c97d889bed65c3; https://github.com/tj-actions/verify-changed-files/security/advisories/GHSA-ghm2-rq8q-wrhc
CVE: CVE-2023-52139
Published: 2023-12-29
Description: Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-285
References: https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64; https://github.com/misskey-dev/misskey/security/advisories/GHSA-7pxq-6xx9-xpgm; https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64
CVE: CVE-2023-7171
Published: 2023-12-29
Description: A vulnerability was found in Novel-Plus up to 4.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file novel-admin/src/main/java/com/java2nb/novel/controller/FriendLinkController.java of the component Friendly Link Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named d6093d[PII_REDACTED]370d7eaf6c53afde9ee45215. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-249307.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/201206030/novel-plus/commit/d6093d[PII_REDACTED]370d7eaf6c53afde9ee45215; https://github.com/JTZ-a/SRC/blob/master/novel-plus/storedXSS2/en-us.md; https://vuldb.com/?ctiid.249307
CVE: CVE-2023-50035
Published: 2023-12-29
Description: PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of "password" parameter is directly used in the SQL query without any sanitization and the SQL Injection payload being executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/hackerhijeck/Exploited/blob/main/Small_CRM/SQL-Injection.md; https://github.com/hackerhijeck/Exploited/blob/main/Small_CRM/SQL-Injection.md
CVE: CVE-2023-50069
Published: 2023-12-29
Description: WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. An attacker can host a malicious payload and perform a test mapping pointing to the attacker's file, and the result will render on the Matched page in the Body area, resulting in the execution of the payload. This occurs because the response body is not validated or sanitized.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/holomekc/wiremock/issues/51; https://github.com/holomekc/wiremock/issues/51
CVE: CVE-2023-50070
Published: 2023-12-29
Description: Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, customer_id, and subject.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/geraldoalcantara/CVE-2023-50070; https://medium.com/%40geraldoalcantarapro/cve-2023-50070-1f58c2a64b1c; https://github.com/geraldoalcantara/CVE-2023-50070
CVE: CVE-2023-50071
Published: 2023-12-29
Description: Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/geraldoalcantara/CVE-2023-50071; https://medium.com/%40geraldoalcantarapro/cve-2023-50071-a20767cb3c7b; https://github.com/geraldoalcantara/CVE-2023-50071
CVE: CVE-2023-52240
Published: 2023-12-29
Description: The Kantega SAML SSO OIDC Kerberos Single Sign-on apps before 6.20.0 for Atlassian products allow XSS if SAML POST Binding is enabled. This affects 4.4.2 through 4.14.8 before 4.14.9, 5.0.0 through 5.11.4 before 5.11.5, and 6.0.0 through 6.19.0 before 6.20.0. The full product names are Kantega SAML SSO OIDC Kerberos Single Sign-on for Jira Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Confluence Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bitbucket Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bamboo Data Center & Server (Kantega SSO Enterprise), and Kantega SAML SSO OIDC Kerberos Single Sign-on for FeCru Server (Kantega SSO Enterprise). (Here, FeCru refers to the Atlassian Fisheye and Crucible products running together.)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/[PII_REDACTED]/Security+Vulnerability+HTML+injection+Cross-site+scripting+in+SAML+POST+binding+Kantega+SSO+Enterprise; https://marketplace.atlassian.com/apps/1211923/kantega-saml-sso-oidc-kerberos-single-sign-on-for-jira?hosting=datacenter&tab=versions; https://marketplace.atlassian.com/apps/1212126/kantega-saml-sso-oidc-kerberos-single-sign-on-for-confluence?hosting=datacenter&tab=overview