PT-2023-26514 · Shirasagi · Shirasagi

Taiga Shirakura · Published 2023-09-05 · Updated 2023-09-08 · CVE-2023-38569

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SHIRASAGI versions prior to 1.18.0

Description A stored cross-site scripting issue allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product. This can lead to unauthorized actions being taken on behalf of the user.

Recommendations For versions prior to 1.18.0, update to version 1.18.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive features until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-38569

Affected Products

Shirasagi

References · 7

• https://osv.dev/vulnerability/CVE-2023-38569 · Vendor Advisory
• https://ss-proj.org/support/954.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38569 · Security Note
• https://twitter.com/VulmonFeeds/status/1699041102223884764 · Twitter Post
• https://twitter.com/CVEnew/status/1698991530755915913 · Twitter Post
• https://jvn.jp/en/jp/JVN82758000 · Note
• https://t.me/cibsecurity/69849 · Telegram Post