CVE-2023-38973
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In version 2.9.7 of Badaso, there is a stored XSS vulnerability in the Add Tag function that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.
Risk Assessment
This vulnerability could lead to session hijacking or data theft, posing a significant security threat to the application and its users.
Recommendation
It is recommended to update to the latest version of Badaso and implement proper input filtering and validation to mitigate XSS risks.
Other vulnerabilities in Badaso v2.9.7
See all- CVE-2023-38970Medium
Badaso versions from 0.0.1 to 2.9.7 contain a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload in the 'Name of member' parameter in the add new member function.
- CVE-2023-38971Medium
Badaso versions 0.0.1 through 2.9.7 have a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload to the rack number parameter in the add new rack function.
- CVE-2023-38974Medium
In version 2.9.7 of Badaso, there is a stored XSS vulnerability in the Edit Category function that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in the Add Tag function of Badaso v2.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS