CVE-2023-42436
Last modified
CVE-2023-42436 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Weseek | Growi | < 3.4.0 |
References
- https://jvn.jp/en/jp/JVN18715935/Third Party Advisory
- https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/Vendor Advisory
- https://jvn.jp/en/jp/JVN18715935/Third Party Advisory
- https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-42436?
How severe is CVE-2023-42436?
How do I fix CVE-2023-42436?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-42428Directory traversal vulnerability in CubeCart prior to 6.5.3…6.5
- CVE-2023-42429Improper buffer restrictions in some Intel NUC BIOS firmware…7.8
- CVE-2023-4243The FULL - Customer plugin for WordPress is vulnerable to Ar…8.8
- CVE-2023-42431Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars…5.4
- CVE-2023-42433Incorrect default permissions in some Endurance Gaming Mode …6.7
- CVE-2023-42435 The affected product is vulnerable to a cross-site requ…8.8
- CVE-2023-42437Rejected reason: This is unused.
- CVE-2023-42438An inconsistent user interface issue was addressed with impr…4.3
- CVE-2023-42439GeoNode is an open source platform that facilitates the crea…6.5
- CVE-2023-4244A use-after-free vulnerability in the Linux kernel's netfilt…7
- CVE-2023-42441Vyper is a Pythonic Smart Contract Language for the Ethereum…5.3
- CVE-2023-42442JumpServer is an open source bastion host and a professional…5.3
Are you affected by CVE-2023-42436?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST