CVE-2023-50072: XSS

Published Jan 13, 2024

Updated

A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authenticated user to upload a note on a file which acts as a stored XSS payload. Any user who opens the note of a document file will trigger the XSS.

Affected Software

1 affected component

OpenKM OpenKM=7.1.40

Event History

Dec 20, 2023

Exploit Published

via GitHub·02:36 PM

Jan 13, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2023-50072?

The severity of CVE-2023-50072 is classified as medium due to the potential for exploitation through stored cross-site scripting.

How do I fix CVE-2023-50072?

To fix CVE-2023-50072, update to a newer version of OpenKM that addresses this stored XSS vulnerability.

Who is affected by CVE-2023-50072?

Authenticated users of OpenKM version 7.1.40 with the Professional Extension are affected by CVE-2023-50072.

What type of vulnerability is CVE-2023-50072?

CVE-2023-50072 is a stored cross-site scripting (XSS) vulnerability.

Can CVE-2023-50072 be exploited by non-authenticated users?

No, CVE-2023-50072 requires an authenticated user to exploit the vulnerability.