PT-2023-19097 · Impatient · Impatient

Sean-Mcrae · Published 2023-01-17 · Updated 2023-01-25 · CVE-2023-23637

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions IMPatienT versions prior to 1.5.2

Description The issue allows stored XSS via onmouseover in certain text fields within a "PATCH /modify onto" request to the ontology builder. This may allow attackers to steal Protected Health Information.

Recommendations For versions prior to 1.5.2, update to version 1.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the ontology builder and avoiding the use of the onmouseover event in text fields within the "PATCH /modify onto" request until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-23637

Affected Products

Impatient

References · 7

• 🔥 https://github.com/lambda-science/IMPatienT/issues/101 · Exploit
• https://github.com/lambda-science/IMPatienT/compare/v1.5.1...v1.5.2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-23637 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23637 · Vendor Advisory
• https://github.com/lambda-science/IMPatienT/releases/tag/v1.5.2 · Note
• https://t.me/cvenotify/42777 · Telegram Post
• https://t.me/cibsecurity/56628 · Telegram Post