CVE-2023-50175: XSS
Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50175?
CVE-2023-50175 is classified as a stored cross-site scripting (XSS) vulnerability, which can lead to significant security risks if exploited.
How do I fix CVE-2023-50175?
To mitigate the risk associated with CVE-2023-50175, upgrade GROWI to version 6.0.0 or later.
What are the affected components in CVE-2023-50175?
The vulnerability affects the App Settings, Markdown Settings, and Customize pages of GROWI prior to version 6.0.0.
What could happen if CVE-2023-50175 is exploited?
Exploiting CVE-2023-50175 allows an attacker to execute arbitrary scripts on a user's web browser, potentially compromising user data.
Is CVE-2023-50175 specific to certain GROWI versions?
Yes, CVE-2023-50175 affects all GROWI versions prior to v6.0.0.