CVE-2023-43708: Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Published Sep 30, 2023

Updated

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "configurationtitle1" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

Affected Software

1 affected component

osCommerce oscommerce=4.12.56860

Event History

Sep 30, 2023

CVE Published

via MITRE·02:01 AM

Data Sourced

via MITRE·02:01 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2023-43708.

What is the severity of CVE-2023-43708?

The severity of CVE-2023-43708 is high.

How does the Cross-Site Scripting (XSS) vulnerability in Os Commerce occur?

The Cross-Site Scripting (XSS) vulnerability in Os Commerce occurs when attackers inject JS through the "configuration_title[1](MODULE_PAYMENT_SAGE_PAY_SERVER_TEXT_TITLE)" parameter.

What is the potential impact of the Cross-Site Scripting (XSS) vulnerability in Os Commerce?

The potential impact of the Cross-Site Scripting (XSS) vulnerability in Os Commerce is the unauthorized execution of scripts within a user's web.

How can I fix the Cross-Site Scripting (XSS) vulnerability in Os Commerce?

To fix the Cross-Site Scripting (XSS) vulnerability in Os Commerce, it is recommended to apply the latest patch or update provided by the vendor.