PT-2023-29318 · Unknown · Easy Address Book Web Server

Rafael Pedrero · Published 2023-10-04 · Updated 2023-10-06 · CVE-2023-4493

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Easy Address Book Web Server version 1.6

Description The issue is a Stored Cross-Site Scripting vulnerability that affects multiple parameters such as firstname, homephone, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate, and workzip through the users admin.ghp file. This allows a remote attacker to store a malicious JavaScript payload in the application to be executed when the page is loaded, resulting in an integrity impact.

Recommendations For Easy Address Book Web Server version 1.6, consider disabling the users admin.ghp file or restricting access to it until a patch is available. Additionally, restrict the use of the affected parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-4493

Affected Products

Easy Address Book Web Server

References · 5

• https://osv.dev/vulnerability/CVE-2023-4493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4493 · Security Note
• https://t.me/cvenotify/58973 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products · Note
• https://t.me/cibsecurity/71577 · Telegram Post