PT-2023-19097 · Impatient · Impatient

Sean-Mcrae · Publicado 2023-01-17 · Atualizado 2023-01-25 · CVE-2023-23637

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions IMPatienT versions prior to 1.5.2

Description The issue allows stored XSS via onmouseover in certain text fields within a "PATCH /modify onto" request to the ontology builder. This may allow attackers to steal Protected Health Information.

Recommendations For versions prior to 1.5.2, update to version 1.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the ontology builder and avoiding the use of the onmouseover event in text fields within the "PATCH /modify onto" request until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-23637

Produtos afetados

Impatient

Referências · 7

• 🔥 https://github.com/lambda-science/IMPatienT/issues/101 · Exploit
• https://github.com/lambda-science/IMPatienT/compare/v1.5.1...v1.5.2 · Correção
• https://github.com/lambda-science/IMPatienT/releases/tag/v1.5.2 · Nota
• https://t.me/cvenotify/42777 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-23637 · Nota de Segurança
• https://t.me/cibsecurity/56628 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-23637 · Aviso do Fabricante