PT-2023-31234 · Shaarli+1 · Shaarli+1

7A6163 · Publicado 2023-12-27 · Atualizado 2024-01-04 · CVE-2023-49469

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shaarli version 0.12.2

Description The issue is a Reflected Cross Site Scripting (XSS) vulnerability, which allows remote attackers to execute arbitrary code via the search tag function. This means an attacker can inject malicious code into the search function, potentially leading to unauthorized actions on the affected system.

Recommendations For Shaarli version 0.12.2, consider disabling the search tag function until a patch is available to prevent exploitation of the Reflected Cross Site Scripting (XSS) vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-49469

Produtos afetados

Debian

Shaarli

Referências · 13

• 🔥 https://github.com/shaarli/Shaarli/issues/2038 · Exploit
• https://github.com/shaarli/Shaarli/releases/tag/v0.13.0 · Nota
• https://github.com/shaarli/Shaarli/commit/326870f216ba52d80488cb4ba3fadcf1247d7cf8 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-49469 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-49469 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1740339410242044323 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2023-49469 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-49469 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-49469 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-49469 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-49469 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1740256348892463382 · Publicação no Twitter
• https://t.me/cvenotify/65347 · Publicação no Telegram