CVE-2023-0650 - YAFNET Signature cross site scripting

Back Back to CVE browser

MEDIUM

YAFNET Signature cross site scripting

Published Feb 2, 2023

5.4

MEDIUM

CVSS 3.1

EPSS 0.67%

Description

A vulnerability was found in YAFNET up to 3.1.11 and classified as problematic. This issue affects some unknown processing of the component Signature Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.12 is able to address this issue. The identifier of the patch is a1442a2bacc3335461b44c250e81f8d99c60735f. It is recommended to upgrade the affected component. The identifier VDB-220037 was assigned to this vulnerability.

Affected products

Vendor n/a Product Yafnet Default
n/a
- Version
  3.1.0
  Status
  affected
  Constraints
  -
- Version
  3.1.1
  Status
  affected
  Constraints
  -
- Version
  3.1.10
  Status
  affected
  Constraints
  -
- Version
  3.1.11
  Status
  affected
  Constraints
  -
- Version
  3.1.2
  Status
  affected
  Constraints
  -
- Version
  3.1.3
  Status
  affected
  Constraints
  -
- Version
  3.1.4
  Status
  affected
  Constraints
  -
- Version
  3.1.5
  Status
  affected
  Constraints
  -
- Version
  3.1.6
  Status
  affected
  Constraints
  -
- Version
  3.1.7
  Status
  affected
  Constraints
  -
- Version
  3.1.8
  Status
  affected
  Constraints
  -
- Version
  3.1.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Yafnet

n/a

Version	Status	Constraints
3.1.0	affected	-
3.1.1	affected	-
3.1.10	affected	-
3.1.11	affected	-
3.1.2	affected	-
3.1.3	affected	-
3.1.4	affected	-
3.1.5	affected	-
3.1.6	affected	-
3.1.7	affected	-
3.1.8	affected	-
3.1.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (7)

https://drive.google.com/drive/folders/1iJuhjLQy3QPIgKKgWUzEEfr_q0boaR00?usp=sharing
exploitMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12684
Advisory
https://github.com/YAFNET/YAFNET/commit/a1442a2bacc3335461b44c250e81f8d99c60735f
patch
https://github.com/YAFNET/YAFNET/releases/tag/v3.1.12
patchRelease Notes
https://github.com/YAFNET/YAFNET/security/advisories/GHSA-mg6p-jjff-7g5m
relatedExploitThird Party Advisory
https://vuldb.com/?ctiid.220037
signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.220037
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://drive.google.com/drive/folders/1iJuhjLQy3QPIgKKgWUzEEfr_q0boaR00?usp=sharing		exploitMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12684		Advisory
https://github.com/YAFNET/YAFNET/commit/a1442a2bacc3335461b44c250e81f8d99c60735f		patch
https://github.com/YAFNET/YAFNET/releases/tag/v3.1.12		patchRelease Notes
https://github.com/YAFNET/YAFNET/security/advisories/GHSA-mg6p-jjff-7g5m		relatedExploitThird Party Advisory
https://vuldb.com/?ctiid.220037		signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.220037		vdb-entrytechnical-descriptionThird Party Advisory