HTML Injection Vulnerability in Grocy by Grocy Team
CVE-2023-48199

7.8HIGH

Key Information:

Vendor

Grocy Project

Status
Grocy
Vendor
CVE Published:
15 November 2023

Badges

👾 Exploit Exists

What is CVE-2023-48199?

An HTML Injection vulnerability exists in the 'manageApiKeys' component of Grocy, allowing attackers to inject arbitrary HTML content due to improper input sanitization. This issue impacts versions of Grocy up to 4.0.3 and may be exploited through manipulated user inputs, leading to unauthorized changes in the displayed content. Attackers can leverage this flaw along with social engineering tactics to exploit user trust, thereby posing a significant risk to the integrity of the web application.

References

https://github.com/grocy/grocy
https://grocy.info
https://nitipoom-jar.github.io/CVE-2023-48199/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.