PT-2023-31144 · Dpaste · Dpaste

Published 2023-12-01 · Updated 2023-12-06 · CVE-2023-49277

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions dpaste versions prior to v3.8

Description A security issue has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities.

Recommendations For dpaste versions prior to v3.8, upgrade to dpaste release v3.8 or later versions to remediate the vulnerability. As a temporary workaround, consider restricting access to the expires parameter in the dpaste API until the patch is applied. No other workarounds have been identified, and applying the patch is the most effective way to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-49277

GHSA-R8J9-5CJ7-CV39

Affected Products

Dpaste

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49277.json · Exploit
• https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39 · Vendor Advisory
• https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-49277 · Security Note
• https://osv.dev/vulnerability/GHSA-r8j9-5cj7-cv39 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49277 · Vendor Advisory
• https://github.com/DarrenOfficial/dpaste · Note
• https://t.me/cvenotify/62608 · Telegram Post
• https://t.me/cvenotify/62022 · Telegram Post