PT-2023-28729 · Submitty · Submitty

Richcfno1 · Published 2023-11-02 · Updated 2023-11-09 · CVE-2023-43193

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Submitty versions prior to 22.06.00

Description The issue allows an attacker to create a malicious link in the forum that leads to Cross Site Scripting (XSS). This can be exploited by an attacker to execute malicious scripts on the victim's browser.

Recommendations For versions prior to 22.06.00, update to version 22.06.00 or later to resolve the issue. As a temporary workaround, consider restricting access to the forum to minimize the risk of exploitation. Avoid using links from untrusted sources in the forum until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-43193

Affected Products

Submitty

References · 8

• 🔥 https://fuchai.net/cve/CVE-2023-43193 · Exploit
• https://github.com/Submitty/Submitty/pull/8032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43193 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43193 · Vendor Advisory
• https://t.me/cibsecurity/73429 · Telegram Post
• https://twitter.com/CVEnew/status/1720039083479556404 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1720089395188163041 · Twitter Post
• https://t.me/cvenotify/60369 · Telegram Post