Reflected Cross-Site Scripting Vulnerability in phpipam by phpipam
CVE-2023-24657

6.1MEDIUM

Key Information:

Vendor

PHPipam

Status
PHPipam
Vendor
CVE Published:
8 March 2023

What is CVE-2023-24657?

A reflected cross-site scripting (XSS) vulnerability was identified in phpipam version 1.6, allowing attackers to exploit the closeClass parameter on the /subnet-masks/popup.php endpoint. This could enable the execution of malicious scripts in the context of the user's session, potentially leading to data theft or unauthorized actions. Users of phpipam are advised to implement security measures to mitigate this risk.

References

https://github.com/phpipam/phpipam/issues/3738

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.