Lucene search

MitreCVE-2023-36287

HistoryJun 23, 2023 - 4:15 p.m.

CVE-2023-36287

2023-06-2316:15:09

CWE-79

mitre

web.nvd.nist.gov

cve-2023

cross-site scripting

xss

vulnerability

webkul qloapps

session cookie

impersonation

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.8%

JSON

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user’s session cookie and then impersonate that user via POST controller parameter.

Affected configurations

Nvd

Node

webkulqloappsMatch1.6.0

VendorProductVersionCPE
webkulqloapps1.6.0cpe:2.3:a:webkul:qloapps:1.6.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
webkul	qloapps	1.6.0	cpe:2.3:a:webkul:qloapps:1.6.0:::::::*

References

flashy-lemonade-192.notion.site/Cross-site-scripting-via-controller-parameter-in-QloApps-1-6-0-97e409ce164f40d195b625b9bf719900?pvs=4

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.8%

JSON

Related for CVE-2023-36287