CVE-2023-44272

2023-10-0409:15:31

CWE-79

[email protected]

web.nvd.nist.gov

xss

vulnerability

citadel

994

javascript

security

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

21.3%

JSON

A cross-site scripting vulnerability exists in Citadel versions prior to 994. When a malicious user sends an instant message with some JavaScript code, the script may be executed on the web browser of the victim user.

Affected configurations

Vulners

NVD

Node

citadelcitadelRange<994

VendorProductVersionCPE
citadelcitadel*cpe:2.3:a:citadel:citadel:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
citadel	citadel	*	cpe:2.3:a:citadel:citadel::::::::

CNA Affected

[
  {
    "vendor": "Citadel",
    "product": "Citadel",
    "versions": [
      {
        "version": "prior to 994",
        "status": "affected"
      }
    ]
  }
]