Stored Cross-Site Scripting Vulnerability in PowerCMS by PowerCMS Inc.
CVE-2023-49117

5.4MEDIUM

Key Information:

Vendor: Alfasado Inc.
Status: PowerCMS (PowerCMS 6 Series); PowerCMS (PowerCMS 5 Series); PowerCMS (PowerCMS 4 Series)
Vendor: CVE Published:; 26 December 2023

🔔 Create Alfasado Inc. Vulnerability Alert

What is CVE-2023-49117?

PowerCMS, developed by PowerCMS Inc., exhibits a stored cross-site scripting vulnerability affecting multiple series, including the unsupported 3 Series. This vulnerability allows attackers to inject arbitrary scripts, which, if executed, can compromise the security of users' sessions in their web browsers. This can lead to unauthorized actions being taken on behalf of legitimate users, posing significant risks to the integrity of user data and overall application security.

Affected Version(s)

PowerCMS (PowerCMS 4 Series) 4.54 and earlier

PowerCMS (PowerCMS 5 Series) 5.24 and earlier

PowerCMS (PowerCMS 6 Series) 6.31 and earlier

References

https://www.powercms.jp/news/release-powercms-202312.html

https://jvn.jp/en/jp/JVN32646742/

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 26, 2023
Vulnerability Reserved
Dec 21, 2023

CVE-2023-49117 Data

JSON