CVE-2023-43232

MediumCVSS 5.4

Published: 27/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

A stored cross-site scripting (XSS) vulnerability was found in DedeBIZ v6.2.11 in the Website column management function. Attackers can inject malicious JavaScript or HTML into the title parameter, leading to script execution in the victim's browser.

Risk Assessment

The risk includes session hijacking, redirection to malicious sites, or theft of sensitive data. Administrators and editors viewing modified content are potential targets.

Recommendation

Immediately update DedeBIZ to the latest version and apply input filtering and encoding for the title parameter. Additionally, implement a Content Security Policy (CSP).

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter.