CVE-2023-3196 - Multiple vulnerabilities in Canopsis of Capensis

Back Back to CVE browser

MEDIUM

Multiple vulnerabilities in Canopsis of Capensis

Published Oct 3, 2023

4.8

MEDIUM

CVSS 3.1

EPSS 0.48%

Description

This vulnerability could allow an attacker to store a malicious JavaScript payload in the login footer and login page description parameters within the administration panel.

Affected products

Vendor Capensis Product Canopsis Default
unaffected
- Version
  23.04-alpha3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Capensis

Canopsis

unaffected

Version	Status	Constraints
23.04-alpha3	affected	-

Remediation

Vendor solution

Canopsis version 23.10.0 includes fixes for the reported vulnerability, and was released on 31 October 2023.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

Link	Providers	Tags
https://git.canopsis.net/canopsis/canopsis-community/-/blob/develop/community/sources/webcore/src/canopsis-next/src/config.js?ref_type=heads#L38
https://git.canopsis.net/canopsis/canopsis-community/-/blob/develop/community/sources/webcore/src/canopsis-next/src/helpers/html.js?ref_type=heads
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canopsis-capensis		Third Party Advisory