Cross-Site Scripting Vulnerability in Seafile by Seafile GmbH
CVE-2023-28873

5.4MEDIUM

Key Information:

Vendor

Seafile

Status
Seafile
Vendor
CVE Published:
9 December 2023

What is CVE-2023-28873?

An XSS vulnerability has been identified in Seafile version 9.0.6, specifically affecting the wiki and discussion pages. This flaw enables attackers to inject malicious JavaScript code into the Markdown editor, potentially compromising user data and session integrity. Proper precautions should be taken to mitigate the risks associated with this vulnerability.

References

https://herolab.usd.de/en/security-advisories/usd-2022-0032/
https://manual.seafile.com/changelog/server-changelog/#90...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.