CVE-2023-42808: GHSL-2023-026: Cross-site scripting (XSS) in Common Voice - CVE-2023-42808
Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets for training voice recognition-related tools. Version 1.88.2 is vulnerable to reflected Cross-Site Scripting given that user-controlled data flows to a path expression (path of a network request). This issue may lead to reflected Cross-Site Scripting (XSS) in the context of Common Voice’s server origin. As of time of publication, it is unknown whether any patches or workarounds exist.
Other sources
Common Voice is vulnerable to Cross-Site Scripting (XSS).
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-42808?
CVE-2023-42808 is a vulnerability in Mozilla Common Voice version 1.88.2 that allows for reflected Cross-Site Scripting.
How severe is CVE-2023-42808?
CVE-2023-42808 has a severity level of medium with a CVSS score of 6.1.
How does CVE-2023-42808 affect Mozilla Common Voice?
CVE-2023-42808 affects Mozilla Common Voice version 1.88.2 by allowing user-controlled data to flow to a vulnerable path, leading to reflected Cross-Site Scripting.
What is Cross-Site Scripting (XSS)?
Cross-Site Scripting (XSS) is a type of security vulnerability where an attacker injects malicious scripts into a trusted website, which are then executed by the victim's browser.
How can I fix CVE-2023-42808 in Mozilla Common Voice 1.88.2?
To fix CVE-2023-42808 in Mozilla Common Voice 1.88.2, it is recommended to apply the latest security patches or updates provided by Mozilla and ensure proper validation and sanitization of user-controlled data to prevent Cross-Site Scripting vulnerabilities.