PT-2023-24249 · Unknown · Papaya Viewer

Lennert Preuth · Published 2023-05-26 · Updated 2025-01-15 · CVE-2023-33255

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Papaya Viewer version 1.0.1449

Description An issue was discovered where user-supplied input in the form of DICOM or NIFTI images can be loaded into the Papaya web application without sanitization. This allows the injection of arbitrary JavaScript code into image metadata, which is executed when the metadata is displayed in the Papaya web application.

Recommendations For Papaya Viewer version 1.0.1449, as a temporary workaround, consider disabling the loading of user-supplied DICOM or NIFTI images into the Papaya web application until a patch is available. Restrict access to the image metadata display feature to minimize the risk of exploitation. Avoid using the Papaya web application to load untrusted images until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-33255

Affected Products

Papaya Viewer

References · 9

• 🔥 http://packetstormsecurity.com/files/172644/Papaya-Medical-Viewer-1.0-Cross-Site-Scripting.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2023/May/21 · Exploit
• https://osv.dev/vulnerability/CVE-2023-33255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33255 · Security Note
• https://schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001.txt · Note
• https://schutzwerk.com/blog/schutzwerk-sa-2022-001 · Note
• https://schutzwerk.com · Note
• https://t.me/cvenotify/107562 · Telegram Post
• https://t.me/cvenotify/51226 · Telegram Post