exploitDog

CVE-2023-36287

Опубликовано: 23 июн. 2023

Источник: nvd

CVSS3: 6.1

EPSS Средний

Описание

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.

Ссылки

https://flashy-lemonade-192.notion.site/Cross-site-scripting-via-controller-parameter-in-QloApps-1-6-0-97e409ce164f40d195b625b9bf719900?pvs=4
Exploit
Third Party Advisory
https://flashy-lemonade-192.notion.site/Cross-site-scripting-via-controller-parameter-in-QloApps-1-6-0-97e409ce164f40d195b625b9bf719900?pvs=4
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:webkul:qloapps:1.6.0:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.20464

Средний

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-hw73-x968-4vhm

CVSS3: 6.1

github

больше 2 лет назад

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.

EPSS

Процентиль: 95%

0.20464

Средний

6.1 Medium

CVSS3

Дефекты

CWE-79