CVE-2023-44272

MEDIUM

5.4

Description

A cross-site scripting vulnerability exists in Citadel versions prior to 994. When a malicious user sends an instant message with some JavaScript code, the script may be executed on the web browser of the victim user.

Details CVE

Score CVSS v3.15.4

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurREQUIRED

Publie10/4/2023

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

citadel:citadel

Faiblesses (CWE)

CWE-79

References

https://code.citadel.org/citadel/citadel(vultures@jpcert.or.jp)

https://code.citadel.org/citadel/citadel/-/commit/f0dac5ff074ad686fa71ea663c8ead107bd3041e(vultures@jpcert.or.jp)

https://jvn.jp/en/jp/JVN08237727/(vultures@jpcert.or.jp)

https://www.citadel.org/download.html(vultures@jpcert.or.jp)

https://code.citadel.org/citadel/citadel(af854a3a-2127-422b-91ae-364da2661108)

https://code.citadel.org/citadel/citadel/-/commit/f0dac5ff074ad686fa71ea663c8ead107bd3041e(af854a3a-2127-422b-91ae-364da2661108)

https://jvn.jp/en/jp/JVN08237727/(af854a3a-2127-422b-91ae-364da2661108)

https://www.citadel.org/download.html(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.