Stored Cross-Site Scripting Vulnerability in WeKan by WeKan
CVE-2023-28485

5.4MEDIUM

Key Information:

Vendor

Wekan Project

Status
Wekan
Vendor
CVE Published:
26 June 2023

What is CVE-2023-28485?

A vulnerability exists in WeKan prior to version 6.75 that enables remote authenticated users to exploit stored cross-site scripting through the file preview feature. This allows a user with BoardAdmin access to rename files, injuring the application's integrity by injecting arbitrary web scripts or HTML into attachment names. This lack of input validation on the renameAttachment function results in potential abuse by malicious users, highlighting a critical need for immediate attention and patching to secure the application.

References

https://wekan.github.io/
https://wekan.github.io/hall-of-fame/filebleed/
http://packetstormsecurity.com/files/172649/Wekan-6.74-Cr...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.