GHSA-rxvj-5mv6-j5mc

Source

https://github.com/advisories/GHSA-rxvj-5mv6-j5mc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-rxvj-5mv6-j5mc/GHSA-rxvj-5mv6-j5mc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rxvj-5mv6-j5mc

Aliases

CVE-2023-3990

Published

2023-07-28T09:30:29Z

Modified

2024-02-16T08:18:26.989160Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Cross-site Scripting in Mingsoft MCMS

Details

A Cross-site Scripting vulnerability has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.

Database specific

{
    "nvd_published_at": "2023-07-28T07:15:09Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-28T20:44:06Z"
}

References

Affected packages

Maven / net.mingsoft:ms-mcms

Package

Name: net.mingsoft:ms-mcms; View open source insights on deps.dev
Purl: pkg:maven/net.mingsoft/ms-mcms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.3.2

Affected versions

4.*

4.6.3-SNAPSHOTS

4.6.5

4.7.1

4.7.2

5.*

5.0.0

5.0.1

5.1

5.2

5.2.0

5.2.0.RELEASE

5.2.1

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

5.2.9

5.2.10

5.2.11

5.3.0

5.3.1

Database specific

{
    "last_known_affected_version_range": "<= 5.3.1"
}