CVE-2023-34452: Grav vulnerable to Self Cross Site Scripting in /forgot_password
Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgotpassword" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the "email" parameter of the request. While this vulnerability can potentially allow an attacker to execute arbitrary code on the user's browser, the impact is limited as it requires user interaction to trigger the vulnerability. As of time of publication, a patch is not available. Server-side validation should be implemented to prevent this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement server-side validation for the /forgot_password endpoint to prevent self-reflected XSS when an attacker injects a script into the request "email" parameter (affects Grav versions 1.7.42 and prior).
Grav /forgot_password Server-side validation for input parameter "email" = Reject/escape/validate email input so script injection in the "email" parameter does not get reflected in responses
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-34452.
What is the severity of CVE-2023-34452?
The severity of CVE-2023-34452 is medium.
How does this vulnerability affect Grav?
This vulnerability affects Grav versions 1.7.42 and prior.
What is the CWE classification for CVE-2023-34452?
The CWE classification for CVE-2023-34452 is CWE-79 (Cross-Site Scripting).
How can this vulnerability be exploited?
This vulnerability can be exploited by injecting a script into the "email" parameter of the "/forgot_password" page.