CVE-2023-31779: XSS

Q: What is CVE-2023-31779?

CVE-2023-31779 is a vulnerability in Wekan v6.84 and earlier that allows an attacker with user privilege to insert JavaScript code in the 'Reaction to comment' feature, resulting in Cross-Site Scripting (XSS) attacks.

Q: What is the severity of CVE-2023-31779?

CVE-2023-31779 has a severity rating of medium with a CVSS score of 5.4.

Q: How does CVE-2023-31779 affect Wekan?

CVE-2023-31779 affects Wekan v6.84 and earlier, allowing an attacker with user privilege to execute cross-site scripting attacks by inserting JavaScript code in the 'Reaction to comment' feature.

Q: How can I fix CVE-2023-31779?

To fix CVE-2023-31779, it is recommended to upgrade Wekan to a version later than v6.84 or apply the necessary patches provided by the vendor.

Q: What is CWE-79?

CWE-79 is a common weakness enumeration identifier for Cross-Site Scripting (XSS) vulnerabilities.

Published May 22, 2023

Updated

Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board can insert JavaScript code in in "Reaction to comment" feature.

Affected Software

1 affected component

Wekan project Wekan<=6.84

Remediation

Patch Available

https://github.com/wekan/wekan/commit/47ac33d6c234359c31d9b5eae49ed3e793907279

Event History

May 22, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is CVE-2023-31779?

CVE-2023-31779 is a vulnerability in Wekan v6.84 and earlier that allows an attacker with user privilege to insert JavaScript code in the 'Reaction to comment' feature, resulting in Cross-Site Scripting (XSS) attacks.

What is the severity of CVE-2023-31779?