CVE-2023-26042: HTML/XSS injection possibilities in Part-DB
Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-26042?
CVE-2023-26042 is a vulnerability in Part-DB, an open source inventory management system, that allows malicious users to inject arbitrary HTML into the pages due to improper escaping of user input.
What is the severity of CVE-2023-26042?
The severity of CVE-2023-26042 is medium with a CVSS score of 6.1.
How does CVE-2023-26042 affect Part-DB?
CVE-2023-26042 affects Part-DB versions 1.0.0 to 1.0.2, allowing malicious users to inject arbitrary HTML into the pages.
How can I fix CVE-2023-26042 in Part-DB?
To fix CVE-2023-26042 in Part-DB, update to version 1.0.2 using the release provided by Part-DB.
What is the CWE classification of CVE-2023-26042?
CVE-2023-26042 has a CWE classification of 79, which is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').