CVE-2023-48644

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-48644
An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feature of the maintenance module, via the description field. This allows an attacker to perform an action on behalf of the user, exfiltrate data, and so on.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48644
https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644 Third Party Advisory
https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:eptura:archibus:4.0.3:*:*:*:iphone_os:*:*:*
History

30 May 2025, 16:15

Type Values Removed Values Added
First Time Eptura
Eptura archibus
References
  • () https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48644 -
References () https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644 - () https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644 - Third Party Advisory
CPE cpe:2.3:a:eptura:archibus:4.0.3:*:*:*:iphone_os:*:*:*
Information

Published : 2024-03-05 23:15

Updated : 2025-05-30 16:15

NVD link : CVE-2023-48644

Mitre link : CVE-2023-48644

CVE.ORG link : CVE-2023-48644

JSON object : View

Products Affected

eptura

  • archibus
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor