CVE-2023-3973
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository jgraph/drawio prior to version 21.6.3.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to upgrade to version 21.6.3 or later to mitigate this vulnerability.
Other vulnerabilities in jgraph/drawio
See all- CVE-2023-3975Critical
There is an OS Command Injection vulnerability in the GitHub repository jgraph/drawio prior to version 21.5.0.
- CVE-2023-3974Critical
There is an OS Command Injection vulnerability in the GitHub repository jgraph/drawio prior to version 21.4.0.
- CVE-2023-3398High
Denial of Service vulnerability exists in the GitHub repository jgraph/drawio prior to version 18.1.3.
- CVE-2023-3026Medium
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository jgraph/drawio prior to version 21.2.8, allowing for the storage of malicious code.
Original NVD description (English source)
Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS