PT-2024-13957 · Nocodb · Nocodb

Pyozzi-Toss · Published 2024-05-13 · Updated 2025-08-21 · CVE-2023-50717

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions 0.202.6 through 0.202.9

Description The issue allows an attacker to upload a html file with malicious content. If a user tries to open that file in a browser, malicious scripts can be executed, leading to a stored cross-site scripting attack. This enables a remote attacker to execute JavaScript code in the context of the user accessing the vector. An attacker could use this to execute requests in the name of a logged-in user or potentially collect information about the attacked user by displaying a malicious form.

Recommendations For NocoDB versions 0.202.6 through 0.202.9, update to version 0.202.10 or later, which contains a patch for the issue. As a temporary workaround, consider restricting the upload of html files or disabling the feature to upload files until a patch is applied. Avoid accessing uploaded files from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2023-50717

GHSA-QG73-G3CF-VHHH

Affected Products

Nocodb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50717.json · Exploit
• https://github.com/nocodb/nocodb/security/advisories/GHSA-qg73-g3cf-vhhh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qg73-g3cf-vhhh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50717 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50717 · Security Note
• https://github.com/nocodb/nocodb · Note
• https://twitter.com/CVEnew/status/1790059601469079624 · Twitter Post
• https://t.me/cveNotify/133019 · Telegram Post