Stored Cross-Site Scripting in Easy Address Book Web Server 1.6 version, through the users_admin.ghp file that affects multiple parameters such as (firstname, homephone, lastname, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate, workzip). This vulnerability allows a remote attacker to store a malicious JavaScript payload in the application to be executed when the page is loaded, resulting in an integrity impact.
References
| Link | Resource |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products | Third Party Advisory |
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:35
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| References | () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products - Third Party Advisory |
06 Oct 2023, 16:20
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-efs-software-products - Third Party Advisory | |
| First Time |
Easy Address Book Web Server Project easy Address Book Web Server
Easy Address Book Web Server Project |
|
| CWE | CWE-79 | |
| CPE | cpe:2.3:a:easy_address_book_web_server_project:easy_address_book_web_server:1.6:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
04 Oct 2023, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-04 13:15
Updated : 2024-11-21 08:35
NVD link : CVE-2023-4493
Mitre link : CVE-2023-4493
CVE.ORG link : CVE-2023-4493
JSON object : View
Products Affected
easy_address_book_web_server_project
- easy_address_book_web_server
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')