CVE-2023-29452CWE-20

Remove possibility to add html into Geomap attribution field

Medium · published July 13, 2023

Patch now

High probability of exploitation

CVSS calls it medium at 5.5. It sits in the 99.2th percentile for exploit probability.

CVSS v3.1

5.5

EPSS

64%

Percentile

99.2

In the wild

Unconfirmed

What it is

Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.

The record

Technical detail

CVSS v3.1: 5.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.64063 · 99.2th percentile
Weakness: CWE-20 · Improper Input Validation
Published: 2023-07-13T09:29Z

EPSS history

Timeline

13 JUL 09:29Z
Remove possibility to add html into Geomap attribution field
cvelistv5