CVE-2023-34452
Last modified
CVE-2023-34452 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the "email" parameter of the request. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the "email" parameter of the request. While this vulnerability can potentially allow an attacker to execute arbitrary code on the user's browser, the impact is limited as it requires user interaction to trigger the vulnerability. As of time of publication, a patch is not available. Server-side validation should be implemented to prevent this vulnerability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Getgrav | Grav | <= 1.7.42 |
References
- https://github.com/getgrav/grav/security/advisories/GHSA-xcr8-cc2j-62fcExploit, Vendor Advisory
- https://github.com/getgrav/grav/security/advisories/GHSA-xcr8-cc2j-62fcExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-34452?
How severe is CVE-2023-34452?
How do I fix CVE-2023-34452?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-34447iTop is an open source, web-based IT service management plat…6.1
- CVE-2023-34448Grav is a flat-file content management system. Prior to vers…7.2
- CVE-2023-34449ink! is an embedded domain specific language to write smart …5.3
- CVE-2023-3445Cross-site Scripting (XSS) - Stored in GitHub repository spi…4.8
- CVE-2023-34450CometBFT is a Byzantine Fault Tolerant (BFT) middleware that…5.3
- CVE-2023-34451CometBFT is a Byzantine Fault Tolerant (BFT) middleware that…8.2
- CVE-2023-34453snappy-java is a fast compressor/decompressor for Java. Due …7.5
- CVE-2023-34454snappy-java is a fast compressor/decompressor for Java. Due …7.5
- CVE-2023-34455snappy-java is a fast compressor/decompressor for Java. Due …7.5
- CVE-2023-34457MechanicalSoup is a Python library for automating interactio…7.5
- CVE-2023-34458mx-chain-go is the official implementation of the MultiversX…5.3
- CVE-2023-34459OpenZeppelin Contracts is a library for smart contract devel…5.9
Are you affected by CVE-2023-34452?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST