8.8

CVE-2023-5378

Stored XSS in SmodBIP and MegaBIP

Improper Input Validation vulnerability in  MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2. MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Megabip ≫ Megabip Version <= 4.36.2
Smod ≫ Smodbip Version <= 2.21
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.53% 0.403
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cvd@cert.pl 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://smod.pl/
Product
https://cert.pl/en/posts/2023/12/CVE-2023-5378
Third Party Advisory
https://cert.pl/posts/2023/12/CVE-2023-5378
Third Party Advisory
https://megabip.pl/
Product