PT-2023-24330 · Skycaiji · Skycaiji

Published 2023-05-26 · Updated 2025-01-15 · CVE-2023-33394

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions skycaiji version 2.5.4

Description The issue allows attackers to achieve backend Cross Site Scripting (XSS) by deploying malicious JSON data. This enables potential exploitation of the system.

Recommendations For skycaiji version 2.5.4, consider validating and sanitizing all JSON data to prevent malicious input. As a temporary workaround, restrict the ability to deploy JSON data from untrusted sources until a fix is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-33394

Affected Products

Skycaiji

References · 4

• 🔥 https://wanheiqiyihu.top/2023/05/02/skycaiji-v2-5-4-has-a-backend-xss-vulnerability · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-33394 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33394 · Vendor Advisory
• https://t.me/cvenotify/107546 · Telegram Post