CVE-2023-43704: Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Published Sep 30, 2023

Updated

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "title" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

Affected Software

1 affected component

osCommerce oscommerce=4.12.56860

Event History

Sep 30, 2023

CVE Published

via MITRE·01:46 AM

Data Sourced

via MITRE·01:46 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2023-43704.

What is the severity of CVE-2023-43704?

The severity of CVE-2023-43704 is high with a CVSS score of 5.4.

Which software is affected by CVE-2023-43704?

Os Commerce version 4.12.56860 is affected by CVE-2023-43704.

How does CVE-2023-43704 work?

CVE-2023-43704 allows attackers to inject malicious JavaScript code through the 'title' parameter, potentially leading to unauthorized execution of scripts on a user's web browser.

Are there any references for CVE-2023-43704?

Yes, you can find references for CVE-2023-43704 at these URLs: [https://fluidattacks.com/advisories/bts/](https://fluidattacks.com/advisories/bts/) and [https://www.oscommerce.com/](https://www.oscommerce.com/).