CVE-2023-42431CWE-20

Potential XSS on user preferences page

Low · published October 30, 2023

CVSS v3.1
2.1
EPSS
0%
Percentile
26.6
In the wild
Unconfirmed
What it is

Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context.

The record
Technical detail
CVSS v3.1
2.1 · LOW
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00343 · 26.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-10-30T10:48Z
EPSS history
Timeline
  • 30 OCT 10:48Z
    Potential XSS on user preferences page
    cvelistv5