CVE-2023-30959CWE-84

Stored XSS via javascript URI in Apollo Change Requests comment

Medium · published September 26, 2023

CVSS v3.1
4.1
EPSS
0%
Percentile
28.4
In the wild
Unconfirmed
What it is

In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00359 · 28.4th percentile
Weakness
CWE-84 · Improper Neutralization of Encoded URI Schemes in a Web Page
Published
2023-09-26T17:56Z
EPSS history
Timeline
  • 26 SEP 17:56Z
    Stored XSS via javascript URI in Apollo Change Requests comment
    cvelistv5