CVE-2023-32193CWE-80

Norman API Cross-site Scripting Vulnerability

High · published October 16, 2024

CVSS v3.1
8.3
EPSS
0%
Percentile
39.4
In the wild
Unconfirmed
What it is

A vulnerability has been identified in which unauthenticated cross-site

scripting (XSS) in Norman's public API endpoint can be exploited. This

can lead to an attacker exploiting the vulnerability to trigger

JavaScript code and execute commands remotely.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00467 · 39.4th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2024-10-16T12:27Z
EPSS history
Timeline
  • 16 OCT 12:27Z
    Norman API Cross-site Scripting Vulnerability
    cvelistv5