VulnerabilityModified

CVE-2023-48644

There is an XSS vulnerability in the create work request feature of the maintenance module, via the description field.

MEDIUM 6.1EPSS 0.31%

Does this matter?

Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feature of the maintenance module, via the description field. This allows an attacker to perform an action on behalf of the user, exfiltrate data, and so on.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.31% probability · 24th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: eptura/archibus
Source: cve@mitre.org

References

https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48644
https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644Third Party Advisory
https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.