CVE-2023-7238
Assigner: icscert
Published: 2024-01-23T19:20:02.324Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Osimis DICOM Web Viewer
vendor: Orthanc
versions: status: affected
version: 1.4.2.0-9d9eff4
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Noam Moshe of Claroty Team82
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.</span>


value: 
A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

<p>Orthanc recommends users mitigate this vulnerability by updating to the Docker images and Windows installers to Orthanc version 24.1.2 or greater.</p><p>Review Orthanc's <a target="_blank" rel="nofollow" href="https://discourse.orthanc-server.org/t/osimis-web-viewer-1-4-3/4206">security bullentin</a>&nbsp;for more details.</p>

<br>
value: 
Orthanc recommends users mitigate this vulnerability by updating to the Docker images and Windows installers to Orthanc version 24.1.2 or greater.

Review Orthanc's  security bullentin https://discourse.orthanc-server.org/t/osimis-web-viewer-1-4-3/4206  for more details.





source: discovery: UNKNOWN
title: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer
x_generator: engine: Vulnogram 0.1.0-dev