CVE-2023-27008: XSS
Published Mar 28, 2023
·Updated
A Cross-site scripting (XSS) vulnerability in the function encryptpassword() in login.tmpl.php in ATutor 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.
Affected Software
1 affected component
ATutor ATutor=2.2.1
Event History
Mar 28, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-27008?
CVE-2023-27008 is considered a medium severity vulnerability due to its potential for XSS attacks.
2
How do I fix CVE-2023-27008?
To fix CVE-2023-27008, you should sanitize input to the encrypt_password() function and update to a secured version of ATutor.
3
What systems are impacted by CVE-2023-27008?
CVE-2023-27008 affects ATutor version 2.2.1 specifically.
4
What type of vulnerability is CVE-2023-27008?
CVE-2023-27008 is a Cross-site scripting (XSS) vulnerability.
5
How can attackers exploit CVE-2023-27008?
Attackers can exploit CVE-2023-27008 by injecting arbitrary web script or HTML via the token parameter.