Medium severity · published Jul 10, 2023
CVE-2023-37153
KodExplorer 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
KodExplorer 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature. An attacker can exploit this vulnerability by injecting XSS syntax into the Description field.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KO
Kodexplorer · Kodcloud
4.51 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37153
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37153
Exploit
https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/KodExplorer4.51.03.md
Product
https://github.com/kalcaddle/KodExplorer
www.chtsecurity.com
https://www.chtsecurity.com/news/13a86b33-7e49-4167-9682-7ff3f51cbcba%20
www.chtsecurity.com
https://www.chtsecurity.com/news/55f0a781-f7bf-4b2f-b2cc-7957fdf846da
More from Kodexplorer
9.8
CVE-2023-6853
kalcaddle KodExplorer app.php index server-side request forgery
9.8
CVE-2023-6852
kalcaddle KodExplorer app.php server-side request forgery
9.8
CVE-2023-6851
kalcaddle KodExplorer ZIP Archive app.php unzipList code injection
9.8
CVE-2023-6850
kalcaddle KodExplorer API Endpoint unrestricted upload
8.8
CVE-2022-4944
kalcaddle KodExplorer cross-site request forgery