Lucene search

ASUSTOR1CVE-2023-2509

HistoryMay 17, 2023 - 7:15 a.m.

CVE-2023-2509

2023-05-1707:15:08

CWE-79

ASUSTOR1

web.nvd.nist.gov

cve-2023-2509

cross-site scripting

xss vulnerability

adm

looksgood

soundsgood

security

nvd

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

18.3%

JSON

A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps. An attacker can exploit this vulnerability to inject malicious scripts into the target applications to access any cookies or sensitive information retained by the browser and used with that application. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below, LooksGood 2.0.0.R129 and below and SoundsGood 2.3.0.r1027 and below.

Affected configurations

Nvd

Node

asustoradmMatch4.0.0

asustoradmMatch4.0.6reg2

asustoradmMatch4.1.0-

asustoradmMatch4.1.0rlq1

asustoradmMatch4.2.1-

asustoradmMatch4.2.1rge2

asustorlooksgoodMatch2.0.0-

asustorlooksgoodMatch2.0.0r129

asustorsoundsgoodMatch2.3.0-

asustorsoundsgoodMatch2.3.0r1027

VendorProductVersionCPE
asustoradm4.0.0cpe:2.3:a:asustor:adm:4.0.0:*:*:*:*:*:*:*
asustoradm4.0.6cpe:2.3:a:asustor:adm:4.0.6:reg2:*:*:*:*:*:*
asustoradm4.1.0cpe:2.3:a:asustor:adm:4.1.0:-:*:*:*:*:*:*
asustoradm4.1.0cpe:2.3:a:asustor:adm:4.1.0:rlq1:*:*:*:*:*:*
asustoradm4.2.1cpe:2.3:a:asustor:adm:4.2.1:-:*:*:*:*:*:*
asustoradm4.2.1cpe:2.3:a:asustor:adm:4.2.1:rge2:*:*:*:*:*:*
asustorlooksgood2.0.0cpe:2.3:a:asustor:looksgood:2.0.0:-:*:*:*:*:*:*
asustorlooksgood2.0.0cpe:2.3:a:asustor:looksgood:2.0.0:r129:*:*:*:*:*:*
asustorsoundsgood2.3.0cpe:2.3:a:asustor:soundsgood:2.3.0:-:*:*:*:*:*:*
asustorsoundsgood2.3.0cpe:2.3:a:asustor:soundsgood:2.3.0:r1027:*:*:*:*:*:*

Vendor	Product	Version	CPE
asustor	adm	4.0.0	cpe:2.3:a:asustor:adm:4.0.0:::::::*
asustor	adm	4.0.6	cpe:2.3:a:asustor:adm:4.0.6:reg2::::::
asustor	adm	4.1.0	cpe:2.3:a:asustor:adm:4.1.0:-::::::
asustor	adm	4.1.0	cpe:2.3:a:asustor:adm:4.1.0:rlq1::::::
asustor	adm	4.2.1	cpe:2.3:a:asustor:adm:4.2.1:-::::::
asustor	adm	4.2.1	cpe:2.3:a:asustor:adm:4.2.1:rge2::::::
asustor	looksgood	2.0.0	cpe:2.3:a:asustor:looksgood:2.0.0:-::::::
asustor	looksgood	2.0.0	cpe:2.3:a:asustor:looksgood:2.0.0:r129::::::
asustor	soundsgood	2.3.0	cpe:2.3:a:asustor:soundsgood:2.3.0:-::::::
asustor	soundsgood	2.3.0	cpe:2.3:a:asustor:soundsgood:2.3.0:r1027::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "packageName": "Web Center",
    "platforms": [
      "Linux",
      "x86",
      "64 bit",
      "ARM"
    ],
    "product": "ADM",
    "vendor": "ASUSTOR",
    "versions": [
      {
        "lessThanOrEqual": "4.0.6.REG2",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.1.0.RLQ1",
        "status": "affected",
        "version": "4.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1.RGE2",
        "status": "affected",
        "version": "4.2",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux",
      "x86",
      "ARM",
      "64 bit"
    ],
    "product": "LooksGood",
    "vendor": "ASUSTOR",
    "versions": [
      {
        "lessThanOrEqual": "2.0.0.R129",
        "status": "affected",
        "version": "2.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux",
      "x86",
      "ARM",
      "64 bit"
    ],
    "product": "SoundsGood",
    "vendor": "ASUSTOR",
    "versions": [
      {
        "lessThanOrEqual": "2.3.0.r1027",
        "status": "affected",
        "version": "2.3",
        "versionType": "custom"
      }
    ]
  }
]

References

www.asustor.com/security/security_advisory_detail?id=22

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

18.3%

JSON

Related for CVE-2023-2509