PT-2023-16397 · Unknown · Projectsend

D47Sec · Published 2023-02-01 · Updated 2023-02-08 · CVE-2023-0607

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions projectsend/projectsend versions prior to r1606

Description The issue is related to Cross-site Scripting (XSS) - Stored, which affects the GitHub repository projectsend/projectsend. This type of attack involves injecting malicious scripts into a website, allowing an attacker to steal user data or take control of the user's session.

Recommendations For versions prior to r1606, update to version r1606 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and implementing additional security measures to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-0607

Affected Products

Projectsend

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0607.json · Exploit
• 🔥 https://huntr.dev/bounties/9294743d-7818-4264-b973-59de027d549b · Exploit
• https://github.com/projectsend/projectsend/commit/698be4ade1db6ae0eaf27c843a03ffc9683cca0a · Patch
• https://osv.dev/vulnerability/CVE-2023-0607 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0607 · Security Note
• https://t.me/cvenotify/43291 · Telegram Post
• https://t.me/cvenotify/43894 · Telegram Post
• https://t.me/cibsecurity/57241 · Telegram Post