PT-2023-30519 · Scrypted · Scrypted

Kevin Stubbings

+1

·

Published

2023-12-13

·

Updated

2024-08-05

·

CVE-2023-47623

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Scrypted versions 0.55.0 and prior
Description Scrypted is a home video integration and automation platform. A reflected cross-site scripting vulnerability exists in the login page via the redirect uri parameter. By specifying a URL with the javascript scheme (javascript:), an attacker can run arbitrary JavaScript code after the login. No known patches are available.
Recommendations For Scrypted versions 0.55.0 and prior, as a temporary workaround, consider restricting access to the login page or disabling the redirect uri parameter until a patch is available. Avoid using the redirect uri parameter with URLs that have the javascript scheme (javascript:) to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-47623
GHSA-WW7P-8GFG-V82R

Affected Products

Scrypted