PT-2023-30449 · Pachno · Pachno

Herombey · Publicado 2023-11-27 · Atualizado 2023-12-01 · CVE-2023-47437

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pachno version 1.0.6

Description A vulnerability has been identified that allows an authenticated attacker to execute a cross-site scripting (XSS) attack. The issue exists due to inadequate input validation in the Project Description and comments, enabling an attacker to inject malicious JavaScript.

Recommendations For Pachno version 1.0.6, consider implementing proper input validation for the Project Description and comments to prevent malicious JavaScript injection. As a temporary workaround, restrict the ability to input JavaScript code in these fields until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-47437

Produtos afetados

Pachno

Referências · 4

• 🔥 https://github.com/herombey/CVE-2023-47437 · Exploit
• https://github.com/pachno/pachno · Nota
• https://osv.dev/vulnerability/CVE-2023-47437 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-47437 · Nota de Segurança