CVE-2023-38758: XSS
Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the licenseauthor field in the add-ingredient function in the templates/ingredients/view.html, models/ingredients.py, and views/ingredients.py components.
Other sources
Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the licenseauthor field in the add-ingredient function in the templates/ingredients/view.html, models/ingredients.py, and views/ingredients.py components.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-38758?
CVE-2023-38758 is classified as a cross-site scripting (XSS) vulnerability that poses a significant security risk.
How do I fix CVE-2023-38758?
To fix CVE-2023-38758, ensure you sanitize user input, particularly in the `license_author` field within the ingredients module.
Which versions of Wger Workout Manager are affected by CVE-2023-38758?
CVE-2023-38758 affects Wger Workout Manager version 2.2.0-a3 and earlier.
Can CVE-2023-38758 allow remote attackers to escalate privileges?
Yes, CVE-2023-38758 can enable remote attackers to gain unauthorized privileges via the vulnerable `license_author` field.
Where is CVE-2023-38758 documented?
CVE-2023-38758 is documented on platforms like NVD and relevant GitHub repositories detailing the vulnerability.