VulnerabilityModified
CVE-2023-45740
Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3.
MEDIUM 5.4EPSS 0.30%
Does this matter?
Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.
Description
Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.30% probability · 22th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- weseek/growi
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/jp/JVN18715935/Third Party Advisory
- https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/Vendor Advisory
- https://jvn.jp/en/jp/JVN18715935/Third Party Advisory
- https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.