Lucene search

PatchstackCVE-2023-48771

HistoryDec 14, 2023 - 5:15 p.m.

CVE-2023-48771

2023-12-1417:15:08

CWE-79

Patchstack

web.nvd.nist.gov

cve-2023-48771

cross-site scripting

xss

file gallery

security vulnerability

web application security

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Bruno “Aesqe” Babic File Gallery allows Reflected XSS.This issue affects File Gallery: from n/a through 1.8.5.4.

Affected configurations

Nvd

Vulners

Node

skyphefile_galleryRange≤1.8.5.4wordpress

VendorProductVersionCPE
skyphefile_gallery*cpe:2.3:a:skyphe:file_gallery:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
skyphe	file_gallery	*	cpe:2.3:a:skyphe:file_gallery::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "file-gallery",
    "product": "File Gallery",
    "vendor": "Bruno \"Aesqe\" Babic",
    "versions": [
      {
        "lessThanOrEqual": "1.8.5.4",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/file-gallery/wordpress-file-gallery-plugin-1-8-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve