CVE-2023-29014 - Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter

Back Back to CVE browser

MEDIUM

Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter

Published Apr 6, 2023

6.1

MEDIUM

CVSS 3.1

EPSS 0.44%

Description

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. The vulnerability has been fixed in version 23.03.

Affected products

Vendor Intranda Product Goobi-Viewer-Core Default
n/a
- Version
  < 23.03
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Intranda

Goobi-Viewer-Core

n/a

Version	Status	Constraints
< 23.03	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://github.com/advisories/GHSA-7v7g-9vx6-vcg2
Advisory
https://github.com/intranda/goobi-viewer-core/commit/c29efe60e745a94d03debc17681c4950f3917455
x_refsource_MISCPatch
https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-7v7g-9vx6-vcg2
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-29014

Link	Providers	Tags
https://github.com/advisories/GHSA-7v7g-9vx6-vcg2		Advisory
https://github.com/intranda/goobi-viewer-core/commit/c29efe60e745a94d03debc17681c4950f3917455		x_refsource_MISCPatch
https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-7v7g-9vx6-vcg2		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-29014