PT-2023-22023 · Seafile · Seafile

CVE-2023-28873 · Publicado 2023-12-08 · Atualizado 2023-12-12

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Seafile version 9.0.6

Description An issue allows attackers to inject JavaScript into the Markdown editor in wiki and discussion pages. This is achieved through an XSS issue, which enables the execution of malicious scripts.

Recommendations For Seafile version 9.0.6, update to a version that includes a fix for this issue to prevent JavaScript injection into the Markdown editor.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-28873

Produtos afetados

Seafile

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28873.json · Exploit
• 🔥 https://herolab.usd.de/en/security-advisories/usd-2022-0032 · Exploit
• https://twitter.com/CVEnew/status/1733379149883154703 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-28873 · Aviso do Fabricante
• https://t.me/cvenotify/63092 · Publicação no Telegram
• https://manual.seafile.com/changelog/server-changelog/#908-2022-09-07 · Nota
• https://twitter.com/VulmonFeeds/status/1733451568979054620 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-28873 · Nota de Segurança