CVE-2023-36223
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A Cross-Site Scripting vulnerability in bbs-go version 3.5.5 and earlier allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'announcements' parameter of the settings function.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other unauthorized actions in the victim's browser context, compromising data confidentiality and integrity.
Recommendation
Immediately upgrade bbs-go to a version later than 3.5.5 and apply output filtering and encoding for the 'announcements' parameter.
Original NVD description (English source)
Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the announcements parameter in the settings function.