JavaScript Injection Vulnerability in Questionnaire Feature of Web Application by Unauthenticated User
CVE-2023-27293

6.1MEDIUM

Key Information:

Vendor

Opencats

Status
Opencats
Vendor
CVE Published:
28 February 2023

What is CVE-2023-27293?

An improperly handled user input during the generation of web pages allows an unauthenticated attacker to inject malicious JavaScript code into a questionnaire submission. When an authenticated user reviews these submissions, the injected script gets executed, potentially enabling the attacker to steal sensitive information such as cookies. This vulnerability underscores the importance of secure coding practices and input validation in web applications.

Affected Version(s)

OpenCATS 0.9.6

References

https://www.tenable.com/security/research/tra-2023-8

EPSS Score

56% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.