Cross-Site Scripting vulnerability in IceHrm
CVE-2023-6282

5.4MEDIUM

Key Information:

Vendor

Icehrm

Status
Icehrm
Vendor
CVE Published:
25 January 2024

What is CVE-2023-6282?

IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting (XSS) vulnerability via /icehrm/app/fileupload_page.php, in multiple parameters. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload and partially hijacking the victim's browser.

Affected Version(s)

IceHrm 23.0.0.OS

References

https://www.incibe.es/en/incibe-cert/notices/aviso/cross-...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafael Pedrero
.