PT-2023-25568 · Khodakhah · Nodcms

Skalvin · Published 2023-07-12 · Updated 2024-05-17 · CVE-2023-3641

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions khodakhah NodCMS version 3.4.1

Description A vulnerability has been found in the component POST Request Handler of the file /en/blog-comment-4. The manipulation of the comment name and comment content arguments leads to cross site scripting. The attack can be launched remotely.

Recommendations For khodakhah NodCMS version 3.4.1, consider disabling the functionality of the file /en/blog-comment-4 to prevent exploitation until a patch is available. Restrict access to the POST Request Handler component to minimize the risk of cross site scripting attacks. Avoid using the comment name and comment content arguments in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-3641

Affected Products

Nodcms

References · 6

• https://osv.dev/vulnerability/CVE-2023-3641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3641 · Security Note
• https://t.me/cvenotify/54697 · Telegram Post
• https://vuldb.com/?id.233887 · Note
• https://vuldb.com/?ctiid.233887 · Note
• https://t.me/cibsecurity/66592 · Telegram Post