CVE-2023-31506: XSS
Published Feb 9, 2024
·Updated
A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element.
Affected Software
2 affected components
composer/getgrav/grav<1.7.44
getgrav Grav<=1.7.44
Event History
Feb 9, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·09:31 AM
Frequently Asked Questions
1
What is the severity of CVE-2023-31506?
CVE-2023-31506 is classified as a high-severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2023-31506?
To mitigate CVE-2023-31506, upgrade your Grav installation to version 1.7.45 or later.
3
Who is affected by CVE-2023-31506?
CVE-2023-31506 affects all remote authenticated users of Grav versions 1.7.44 and earlier.
4
What are the consequences of CVE-2023-31506?
Exploitation of CVE-2023-31506 can lead to unauthorized execution of arbitrary web scripts or HTML.
5
How does CVE-2023-31506 work?
CVE-2023-31506 exploits the onmouseover attribute of the ISINDEX element to execute scripts in the context of the affected web application.