Cross Site Scripting Vulnerability in InvoicePlane Software by InvoicePlane
CVE-2023-23011

6.1MEDIUM

Key Information:

Vendor

Invoiceplane

Status
Invoiceplane
Vendor
CVE Published:
7 February 2023

What is CVE-2023-23011?

An XSS vulnerability has been identified in InvoicePlane 1.6 that allows attackers to inject malicious scripts via the 'filter_product' input in the modal_product_lookups.php file. This flaw could lead to unauthorized access, data theft, and unauthorized actions on behalf of users, highlighting the importance of implementing robust input validation and sanitization measures to safeguard against such threats.

References

https://gist.github.com/enferas/e4ab1aedd9727c3b09c7d0154...
https://gist.github.com/enferas/e8fff9261526fdf51808c39b3...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.