exploitDog

CVE-2023-36288

Опубликовано: 23 июн. 2023

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.

Ссылки

https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-admin-dashboard-via-configure-parameter-in-QloApps-1-6-0-b6303661ac6a47e4b7a6f23cf2818a52?pvs=4
Exploit
Third Party Advisory
https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-admin-dashboard-via-configure-parameter-in-QloApps-1-6-0-b6303661ac6a47e4b7a6f23cf2818a52?pvs=4
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:webkul:qloapps:1.6.0:*:*:*:*:*:*:*

EPSS

Процентиль: 30%

0.00108

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-qq83-6xfj-jf89

CVSS3: 5.4

github

больше 2 лет назад

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.

EPSS

Процентиль: 30%

0.00108

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79