CVE-2023-27293: XSS
Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. This could be used to steal other users’ cookies and force users to make actions without their knowledge.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-27293?
CVE-2023-27293 is classified as a high-severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2023-27293?
To fix CVE-2023-27293, ensure that user inputs are properly sanitized and validated before being rendered in a web page.
Who is affected by CVE-2023-27293?
CVE-2023-27293 affects users of Opencats version 0.9.6, allowing unauthenticated attackers to exploit the vulnerability.
What kind of attack can be executed using CVE-2023-27293?
CVE-2023-27293 allows attackers to execute malicious JavaScript that can steal user cookies when an authenticated user views the compromised submission.
Is CVE-2023-27293 exploitable without authentication?
Yes, CVE-2023-27293 is exploitable by unauthenticated attackers, making it particularly dangerous.