PT-2023-8871 · Unknown · Racktables

Nitipoom Jaroonchaipipat · Published 2023-11-11 · Updated 2025-05-28 · CVE-2023-49453

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RackTables versions prior to 0.22.0

Description The issue exists due to the lack of protection for the web page structure in the /index.php?page=search component of the RackTables web application for managing data center assets. This allows a remote attacker to exploit the vulnerability and potentially disclose sensitive information. The vulnerability is a reflected cross-site scripting (XSS) issue, which enables local attackers to execute arbitrary code and obtain sensitive information via the search component in index.php.

Recommendations For RackTables versions prior to 0.22.0, consider disabling the search component in index.php until a patch is available to prevent exploitation. Restrict access to the search functionality to minimize the risk of arbitrary code execution and sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-02509

CVE-2023-49453

Affected Products

Racktables

References · 9

• 🔥 https://nitipoom-jar.github.io/CVE-2023-49453 · Exploit
• https://osv.dev/vulnerability/CVE-2023-49453 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02509 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-49453 · Security Note
• https://twitter.com/VulmonFeeds/status/1767502424548204927 · Twitter Post
• https://t.me/cvenotify/123911 · Telegram Post
• https://twitter.com/CVEnew/status/1767451732676661537 · Twitter Post
• https://t.me/cvenotify/73538 · Telegram Post
• https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-49453 · Note