Stored Cross-Site Scripting Vulnerability in SHIRASAGI by SS Project
CVE-2023-22425

5.4MEDIUM

Key Information:

Vendor

Shirasagi Project

Status
Shirasagi
Vendor
CVE Published:
24 February 2023

What is CVE-2023-22425?

A stored cross-site scripting vulnerability exists in the Schedule function of SHIRASAGI versions prior to v1.16.2. This flaw allows remote authenticated attackers to inject arbitrary scripts that can then be executed in the context of users' browsers, potentially leading to unauthorized actions or data exposure. Users of the affected versions are encouraged to update to the latest release to mitigate this risk.

Affected Version(s)

SHIRASAGI v1.16.2 and earlier versions

References

https://www.ss-proj.org/
https://github.com/shirasagi/shirasagi
https://www.ss-proj.org/support/938.html

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.