CVE-2023-54341: Webgrind 1.1 - Reflected Cross-Site Scripting (XSS) via file Parameter
Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file parameter in index.php. The application does not sufficiently encode user-controlled inputs, allowing attackers to execute arbitrary JavaScript in victim's browsers by crafting malicious URLs.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54341?
CVE-2023-54341 is classified as a medium severity reflected cross-site scripting vulnerability.
How do I fix CVE-2023-54341?
To fix CVE-2023-54341, you should upgrade to Webgrind version 1.2 or later where this vulnerability has been patched.
Who is affected by CVE-2023-54341?
CVE-2023-54341 affects all versions of Webgrind up to and including version 1.1.
What is the exploit vector for CVE-2023-54341?
The exploit vector for CVE-2023-54341 is via the 'file' parameter in the index.php file.
Can CVE-2023-54341 be exploited without authentication?
Yes, CVE-2023-54341 can be exploited by unauthenticated attackers.