CVE-2023-3469: Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2.
Other sources
IBM ICP4A - Automation Decision Services allows web pages to be stored locally which can be read by another user on the system.
phpMyFAQ prior to 3.2.0-beta.2 contains a cross-site scripting vulnerability. When an administrator restores a backup from a file, it's possible to trigger an error with a specially crafted file that can be displayed on the web page. Since the error message contains the invalid part of the file, any JavaScript code in the file is executed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/thorsten/phpmyfaqto a version that resolves this vulnerability.Fixed in 3.2.0-beta.2
Event History
Frequently Asked Questions
What is CVE-2023-3469?
CVE-2023-3469 is a vulnerability in IBM ICP4A - Automation Decision Services that allows for cross-site scripting (XSS) attacks.
What is the severity of CVE-2023-3469?
The severity of CVE-2023-3469 is medium, with a CVSS score of 4.8.
Which software versions are affected by CVE-2023-3469?
The affected versions include IBM Cloud Pak for Business Automation V22.0.2, V21.0.3 - V21.0.3-IF016, V22.0.1 - V22.0.1-IF006 and later fixes, V21.0.2 - V21.0.2-IF012 and later fixes, V21.0.1 - V21.0.1-IF007 and later fixes, V20.0.1 - V20.0.3 and later fixes, V19.0.1 - V19.0.3 and later fixes, and V18.0.0 - V18.0.2 and later fixes, as well as Phpmyfaq versions up to 3.1.14, 3.2.0-alpha, and 3.2.0-beta.
How can I exploit the vulnerability in CVE-2023-3469?
As a user, you can exploit the vulnerability in CVE-2023-3469 by injecting malicious scripts into web pages on the affected system, which can then be executed by other users who access the pages.
How do I fix the vulnerability in CVE-2023-3469?
To fix the vulnerability in CVE-2023-3469, it is recommended to update to a version of IBM Cloud Pak for Business Automation that includes the necessary fixes, or update to a version of Phpmyfaq that is not affected by the vulnerability.