CVE-2023-29016CWE-79

Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames

Medium · published April 6, 2023

CVSS v3.1
6.1
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when using nicknames. An attacker could create a user account and enter malicious scripts into their profile's nickname, resulting in the execution in the user's browser when displaying the nickname on certain pages. The vulnerability has been fixed in version 23.03.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00443 · 37.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-04-06T19:03Z
EPSS history
Timeline
  • 06 APR 19:03Z
    Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames
    cvelistv5