PT-2023-30041 · Zentao · Zentao

Published 2023-10-31 · Updated 2023-11-09 · CVE-2023-46475

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZenTao version 18.3

Description A Stored Cross-Site Scripting issue was discovered where a user can create a project and inject malicious JavaScript code in the project's name field.

Recommendations For ZenTao version 18.3, consider restricting the ability to create projects or limiting the input in the project name field to prevent the injection of malicious JavaScript code until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-46475

Affected Products

Zentao

References · 8

• 🔥 https://github.com/elementalSec/CVE-Disclosures/blob/main/ZentaoPMS/CVE-2023-46475/CVE-2023-46475%20-%20Cross-Site%20Scripting%20%28Stored%29.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-46475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46475 · Security Note
• https://github.com/easysoft/zentaopms · Note
• https://t.me/cibsecurity/73428 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1719509826139472161 · Twitter Post
• https://t.me/cvenotify/60372 · Telegram Post
• https://twitter.com/CVEnew/status/1720055344343499063 · Twitter Post