PT-2023-31234 · Shaarli+1 · Shaarli+1

7A6163 · Published 2023-12-27 · Updated 2024-01-04 · CVE-2023-49469

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shaarli version 0.12.2

Description The issue is a Reflected Cross Site Scripting (XSS) vulnerability, which allows remote attackers to execute arbitrary code via the search tag function. This means an attacker can inject malicious code into the search function, potentially leading to unauthorized actions on the affected system.

Recommendations For Shaarli version 0.12.2, consider disabling the search tag function until a patch is available to prevent exploitation of the Reflected Cross Site Scripting (XSS) vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-49469

Affected Products

Debian

Shaarli

References · 13

• 🔥 https://github.com/shaarli/Shaarli/issues/2038 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-49469 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-49469 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-49469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49469 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49469 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-49469 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-49469 · Vendor Advisory
• https://github.com/shaarli/Shaarli/releases/tag/v0.13.0 · Note
• https://github.com/shaarli/Shaarli/commit/326870f216ba52d80488cb4ba3fadcf1247d7cf8 · Note
• https://twitter.com/VulmonFeeds/status/1740339410242044323 · Twitter Post
• https://twitter.com/CVEnew/status/1740256348892463382 · Twitter Post
• https://t.me/cvenotify/65347 · Telegram Post