CVE-2023-36463

Meldekarten generator is an open source project to create a program, running locally in the browser without the need for an internet-connection, to create, store and print registration cards for volunteers. All text fields on the webpage are vulnerable to XSS attacks. The user input isn't (fully) sanitized after submission. This issue has been addressed in commit `77e04f4af` which is included in the `1.0.0b1.1.2` release. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/jucktnich/meldekarten-generator/commit/77e04f4af85a6d0b08e616d40eaa81877a108c96	Patch
https://github.com/jucktnich/meldekarten-generator/security/advisories/GHSA-f2gp-85cr-vgj7	Exploit
https://github.com/jucktnich/meldekarten-generator/commit/77e04f4af85a6d0b08e616d40eaa81877a108c96	Patch
https://github.com/jucktnich/meldekarten-generator/security/advisories/GHSA-f2gp-85cr-vgj7	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:meldekarten_generator_project:meldekarten_generator:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-06-27 20:15

Updated : 2024-11-21 08:09

NVD link : CVE-2023-36463

Mitre link : CVE-2023-36463

CVE.ORG link : CVE-2023-36463

JSON object : View

Products Affected

meldekarten_generator_project

meldekarten_generator

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-36463", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2023-06-27T20:15:09.727", "references": [{"url": "https://github.com/jucktnich/meldekarten-generator/commit/77e04f4af85a6d0b08e616d40eaa81877a108c96", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jucktnich/meldekarten-generator/security/advisories/GHSA-f2gp-85cr-vgj7", "tags": ["Exploit"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jucktnich/meldekarten-generator/commit/77e04f4af85a6d0b08e616d40eaa81877a108c96", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/jucktnich/meldekarten-generator/security/advisories/GHSA-f2gp-85cr-vgj7", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Meldekarten generator is an open source project to create a program, running locally in the browser without the need for an internet-connection, to create, store and print registration cards for volunteers. All text fields on the webpage are vulnerable to XSS attacks. The user input isn't (fully) sanitized after submission. This issue has been addressed in commit `77e04f4af` which is included in the `1.0.0b1.1.2` release. Users are advised to upgrade. There are no known workarounds for this vulnerability. "}], "lastModified": "2024-11-21T08:09:45.857", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:meldekarten_generator_project:meldekarten_generator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6AECD1E-2EE5-49E2-97F1-A4884E8DCDDD", "versionEndExcluding": "1.0.0b1.1.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}