PT-2023-22632 · Payatu · Payatu Chatengine

Akshat Singhal · Published 2023-07-06 · Updated 2023-07-12 · CVE-2023-30322

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Payatu ChatEngine version 1.0

Description The issue is related to a Cross Site Scripting (XSS) vulnerability in the username field, located in the /src/chatbotapp/chatWindow.java file. This vulnerability allows attackers to execute arbitrary code.

Recommendations For Payatu ChatEngine version 1.0, consider disabling the username field in the chatWindow.java file as a temporary workaround until a patch is available. Restrict access to the chatWindow.java file to minimize the risk of exploitation. Avoid using the username field in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-30322

Affected Products

Payatu Chatengine

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-30322 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30322 · Vendor Advisory
• https://github.com/wliang6/ChatEngine/blob/master/src/chatbotapp/chatWindow.java#L71:L81 · Note
• https://t.me/cibsecurity/66114 · Telegram Post
• https://payatu.com/advisory/cross-site-scripting-xss-in-username-field-in-chatwindow-functionality-in-chatengine-1-0 · Note