Medium severity · published Feb 28, 2023
CVE-2023-27293
Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be…
6.1
CVSS
57%
EPSS
No
On KEV
Description
Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. This could be used to steal other users’ cookies and force users to make actions without their knowledge.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)57.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opencats · Opencats
0.9.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-27293
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-27293
Exploit
https://www.tenable.com/security/research/tra-2023-8
More from Opencats
9.8
CVE-2021-47936
OpenCATS 0.9.4 Remote Code Execution via Resume Upload
9.8
CVE-2022-48011
Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function
9.8
CVE-2022-43019
OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality
9.8
CVE-2021-41560
OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php
9.8
CVE-2021-25294
OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution