PT-2023-30339 · Unknown+1 · Hoteldruid+1

Tomoro Taniguchi · Published 2023-11-10 · Updated 2023-11-16 · CVE-2023-47164

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HOTELDRUID versions 3.0.5 and earlier

Description A cross-site scripting issue allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product. This enables the attacker to perform actions as the victim user.

Recommendations For HOTELDRUID versions 3.0.5 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-47164

Affected Products

Debian

Hoteldruid

References · 12

• https://ubuntu.com/security/CVE-2023-47164 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47164 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-47164 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-47164 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-47164 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-47164 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47164 · Vendor Advisory
• https://hoteldruid.com/en/download.html · Note
• https://jvn.jp/en/jp/JVN99177549 · Note
• https://twitter.com/VulmonFeeds/status/1722944284184211645 · Twitter Post
• https://hoteldruid.com · Note
• https://twitter.com/CVEnew/status/1722905930118140380 · Twitter Post