Medium severity · published Mar 5, 2024
CVE-2023-48644
An issue was discovered in the Archibus app 4.0.3 for iOS
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feature of the maintenance module, via the description field. This allows an attacker to perform an action on behalf of the user, exfiltrate data, and so on.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Archibus · Eptura
4.0.3 · source: NVD
AI
Archibus Ios Application · Eptura
4.0.3 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-48644
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-48644
cds.thalesgroup.com
https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48644
Third Party Advisory
https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644
More from Archibus
9.6
CVE-2026-107188
Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
8.6
CVE-2026-107186
Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
8.5
CVE-2026-107187
Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables
7.8
CVE-2023-48645
An issue was discovered in the Archibus app 4.0.3 for iOS
7.5
CVE-2025-25652
In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal