CVE-2023-42431
Assigner: HW
Published: 2023-10-30T10:48:21.487Z
State: PUBLISHED
affected: defaultStatus: affected
product: BlueSpice
vendor: Hallo Welt! GmbH
versions: lessThanOrEqual: 4.3.2
status: affected
version: 4
versionType: major
lessThanOrEqual: 3.2.10
status: affected
version: 3
versionType: major
datePublic: 2023-10-30T12:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context.
value: Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context.
impacts: capecId: CAPEC-63
descriptions: value: CAPEC-63 Cross-Site Scripting (XSS)
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 2.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-20
description: CWE-20 Improper Input Validation
type: CWE
source: discovery: UNKNOWN
title: Potential XSS on user preferences page
x_generator: engine: Vulnogram 0.1.0-dev