Lucene search

PatchstackCVE-2023-24396

HistoryApr 06, 2023 - 2:15 p.m.

CVE-2023-24396

2023-04-0614:15:08

CWE-79

Patchstack

web.nvd.nist.gov

cve-2023-24396

authorization

stored cross-site scripting

xss

e4j s.r.l.

vikbooking

hotel booking engine

pms plugin

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

21.0%

JSON

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.11 versions.

Affected configurations

Nvd

Vulners

Node

vikwpvikbooking_hotel_booking_engine_\&_pmsRange<1.5.12wordpress

VendorProductVersionCPE
vikwpvikbooking_hotel_booking_engine_\&_pms*cpe:2.3:a:vikwp:vikbooking_hotel_booking_engine_\&_pms:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
vikwp	vikbooking_hotel_booking_engine_\&_pms	*	cpe:2.3:a:vikwp:vikbooking_hotel_booking_engine_\&_pms::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "vikbooking",
    "product": "VikBooking Hotel Booking Engine & PMS",
    "vendor": "E4J s.r.l.",
    "versions": [
      {
        "changes": [
          {
            "at": "1.5.12",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.5.11",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/vikbooking/wordpress-vikbooking-plugin-1-5-11-cross-site-scripting-xss?_s_id=cve