CVE-2023-0301

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-0301

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0301.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-0301

Published

2023-01-14T00:00:00Z

Modified

2026-08-12T13:32:23Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Cross-site Scripting (XSS) - Stored in alfio-event/alf.io

Details

Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301.

Database specific

{
    "cna_assigner":  "@huntrdev",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0301.json"
}

References

Affected packages

Git / github.com/alfio-event/alf.io

Affected ranges

Type

GIT

Repo

https://github.com/alfio-event/alf.io

Events

Introduced

Fixed

455a32b6f7945afec2b2c66183df7b5821a8ee99

Fixed

21cb2866e5f58b4a2b4a2cb0066479bbb26f7b39

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:opencollective:alf.io:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.0-m4-2301"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.10

1.10-RC1

1.10-RC2

1.10.1

1.11

1.12

1.12-RC1

1.12-RC2

1.12-RC3

1.12-RC4

1.13

1.13-RC1

1.13-RC2

1.13-RC3

1.14

1.14-RC1

1.14-RC2

1.14.1

1.4

1.4-RC2

1.4.1

1.5

1.6

1.7

1.8

1.8-RC1

1.8-RC2

1.9

1.9.1

2.*

2.0-M0

2.0-M1

2.0-M1-1906

2.0-M1-1906.1

2.0-M2

2.0-M3

2.0-M4

2.0-M4-2204

2.0-M4.RC1

2.0-M4.RC2

2.0-M4.RC3

2.0-M4.RC4

alfio-1.*

alfio-1.1

alfio-1.2

alfio-1.3

alfio-1.3-beta1

alfio-1.3.1

v1.*

v1.0-pre-rename

v1.0-pre-rename-v2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0301.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "68846283296469378131805443647897803767",
                "279998413919888834805858215582955449379",
                "232926978335817424840819644456683853591",
                "193115628008857031759632966588593145398",
                "220030138828722455197565351275585201023",
                "254954133637711026716346293143141461367",
                "249501104614585009655818229478155078445",
                "206906582023345320325096260432889460101"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2023-0301-624868ba",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/alfio-event/alf.io/commit/21cb2866e5f58b4a2b4a2cb0066479bbb26f7b39",
        "target":  {
            "file":  "src/main/java/alfio/util/MustacheCustomTag.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "65007181674147535373790451700431773779",
                "248350677222559942511562736692523656593"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2023-0301-b20fb888",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/alfio-event/alf.io/commit/21cb2866e5f58b4a2b4a2cb0066479bbb26f7b39",
        "target":  {
            "file":  "src/test/java/alfio/util/MustacheCustomTagTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "81492722747828412057879682520266608564",
            "length":  499
        },
        "id":  "CVE-2023-0301-eb802017",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/alfio-event/alf.io/commit/21cb2866e5f58b4a2b4a2cb0066479bbb26f7b39",
        "target":  {
            "file":  "src/main/java/alfio/util/MustacheCustomTag.java",
            "function":  "setAttributes"
        }
    }
]

vanir_signatures_modified

"2026-08-12T13:32:23Z"