CVE-2023-6027 Cross-site Scripting vulnerability in PHPMemcachedAdmin

2023-11-3013:38:43

CWE-79

INCIBE

www.cve.org

critical

xss vulnerability

phpmemcachedadmin

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

14.2%

JSON

A critical flaw has been identified in elijaa/phpmemcachedadmin affecting version 1.3.0, specifically related to a stored XSS vulnerability. This vulnerability allows malicious actors to insert a carefully crafted JavaScript payload. The issue arises from improper encoding of user-controlled entries in the “/pmcadmin/configure.php” parameter.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "PHPMemcachedAdmin ",
    "vendor": "PHPMemcachedAdmin ",
    "versions": [
      {
        "status": "affected",
        "version": "1.3.0"
      }
    ]
  }
]