PT-2024-12285 · Grav · Grav

M3N0Sd0N4Ld · CVE-2023-31506 · Published 2024-02-09 · Updated 2024-02-15

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Grav versions 1.7.44 and before

Description A cross-site scripting (XSS) vulnerability allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element.

Recommendations For Grav versions 1.7.44 and before, consider disabling the onmouseover attribute of ISINDEX elements as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-31506

GHSA-XRF8-CMRG-7436

Affected Products

Grav

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31506.json · Exploit
• 🔥 https://m3n0sd0n4ld.github.io/patoHackventuras/cve-2023-31506 · Exploit
• https://osv.dev/vulnerability/CVE-2023-31506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31506 · Security Note
• https://osv.dev/vulnerability/GHSA-xrf8-cmrg-7436 · Vendor Advisory
• https://github.com/getgrav/grav · Note
• https://twitter.com/CVEnew/status/1755852415390142603 · Twitter Post
• https://t.me/cvenotify/70813 · Telegram Post
• https://t.me/cvenotify/70775 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1755927043059982819 · Twitter Post
• https://twitter.com/David_Uton/status/1755873353569612012 · Twitter Post