Stored Cross-Site Scripting Vulnerability in SHIRASAGI by SS Project
CVE-2023-22427

4.8MEDIUM

Key Information:

Vendor

Shirasagi Project

Status
Shirasagi
Vendor
CVE Published:
24 February 2023

What is CVE-2023-22427?

The Theme switching function within SHIRASAGI versions prior to 1.16.2 is susceptible to a stored cross-site scripting vulnerability. This flaw enables remote attackers with administrative privileges to inject arbitrary scripts, potentially leading to unauthorized access or control over the affected application. It is essential for administrators to apply necessary updates and implement security measures to mitigate the risk associated with this vulnerability.

Affected Version(s)

SHIRASAGI v1.16.2 and earlier versions

References

https://www.ss-proj.org/
https://github.com/shirasagi/shirasagi
https://www.ss-proj.org/support/938.html

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.