PT-2023-22023 · Seafile · Seafile

Published 2023-12-08 · Updated 2023-12-12 · CVE-2023-28873

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Seafile version 9.0.6

Description An issue allows attackers to inject JavaScript into the Markdown editor in wiki and discussion pages. This is achieved through an XSS issue, which enables the execution of malicious scripts.

Recommendations For Seafile version 9.0.6, update to a version that includes a fix for this issue to prevent JavaScript injection into the Markdown editor.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28873

Affected Products

Seafile

References · 7

• 🔥 https://herolab.usd.de/en/security-advisories/usd-2022-0032 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-28873 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28873 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1733451568979054620 · Twitter Post
• https://manual.seafile.com/changelog/server-changelog/#908-2022-09-07 · Note
• https://twitter.com/CVEnew/status/1733379149883154703 · Twitter Post
• https://t.me/cvenotify/63092 · Telegram Post