Advisory details:
github_osv / GHSA-rxvj-5mv6-j5mc
| Advisory ID | github_osv/GHSA-rxvj-5mv6-j5mc |
| Aliases |
CVE-2023-3990
|
| Summary | Cross-site Scripting in Mingsoft MCMS A Cross-site Scripting vulnerability has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 3.1 |
| Risk | 1.6 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3 | 3.5 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-rxvj-5mv6-j5mc/GHSA-rxvj-5mv6-j5mc.json |
| generic_textual | LOW |
| Reference id | Reference type | URL |
|---|---|---|
| https://gitee.com/mingSoft/MCMS/issues/I7K4DQ | ||
| https://github.com/ming-soft/MCMS | ||
| https://vuldb.com/?ctiid.235611 | ||
| https://vuldb.com/?id.235611 | ||
| CVE-2023-3990 | https://nvd.nist.gov/vuln/detail/CVE-2023-3990 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.