Potential XSS on user preferences page
CVE-2023-42431

2.1LOW

Key Information:

Vendor

Hallo Welt! Gmbh

Status
Bluespice
Vendor
CVE Published:
30 October 2023

What is CVE-2023-42431?

Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context.

Affected Version(s)

BlueSpice 4 <= 4.3.2

BlueSpice 4 <= 4.3.2

BlueSpice 3 <= 3.2.10

References

https://en.wiki.bluespice.com/wiki/Security:Security_Advi...

CVSS V3.1

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.