PT-2023-32650 · Unknown · Voovi Social Networking Script

Rafael Pedrero · Published 2023-11-30 · Updated 2023-12-02 · CVE-2023-6419

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Voovi Social Networking Script version 1.0

Description A vulnerability has been reported that allows a XSS via editprofile.php in multiple parameters. The exploitation of this issue could allow a remote attacker to send a specially crafted JavaScript payload and partially take over the browser session of an authenticated user.

Recommendations For Voovi Social Networking Script version 1.0, consider restricting access to the editprofile.php page until a patch is available. As a temporary workaround, avoid using the vulnerable parameters in the editprofile.php endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6419

Affected Products

Voovi Social Networking Script

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-6419 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6419 · Vendor Advisory
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-voovi-social-networking-script · Note
• https://twitter.com/CVEnew/status/1730219724984737855 · Twitter Post