Cross Site Scripting Vulnerability in NASA Open MCT Software
CVE-2023-45885

5.4MEDIUM

Key Information:

Vendor

Nasa

Status
Openmct
Vendor
CVE Published:
9 November 2023

What is CVE-2023-45885?

A Cross Site Scripting (XSS) vulnerability exists in NASA’s Open MCT software, specifically affecting versions up to 3.1.0. This flaw allows attackers to execute arbitrary code by exploiting the new component feature in the flexibleLayout plugin. By utilizing this vulnerability, an attacker can potentially manipulate the web application to perform malicious actions, thereby compromising the security and integrity of the system. It is essential for users to be aware of this vulnerability to take the necessary steps to secure their installations.

References

https://www.linkedin.com/pulse/xss-nasas-open-mct-v302-vi...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-45885 : Cross Site Scripting Vulnerability in NASA Open MCT Software