CVE-2023-46394: XSS
Published Oct 27, 2023
·Updated
A stored cross-site scripting (XSS) vulnerability in /home/user/editsubmit of gougucms v4.08.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the headimgurl parameter.
Affected Software
1 affected component
gougucms gougucms=4.08.18
Event History
Oct 27, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-46394?
The severity of CVE-2023-46394 is medium with a CVSS score of 5.4.
2
How does the stored cross-site scripting (XSS) vulnerability in CVE-2023-46394 work?
The vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the headimgurl parameter in the /home/user/edit_submit of gougucms v4.08.18.
3
Which version of Gougucms is affected by CVE-2023-46394?
The vulnerability affects Gougucms version 4.08.18.
4
What is the CWE ID associated with CVE-2023-46394?
The CWE ID associated with CVE-2023-46394 is CWE-79.
5
How can I fix the stored cross-site scripting (XSS) vulnerability in CVE-2023-46394?
To fix the vulnerability, update to a patched version of Gougucms that addresses the issue.