// For flags

CVE-2023-4492

Easy Address Book Web Server XSS vulnerability

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Vulnerability in Easy Address Book Web Server 1.6 version, affecting the parameters (firstname, homephone, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate and workzip) of the /addrbook.ghp file, allowing an attacker to inject a JavaScript payload specially designed to run when the application is loaded

Vulnerabilidad en la versión 1.6 de Easy Address Book Web Server, que afecta los parámetros (nombre, teléfono particular, apellido, segundo nombre, dirección de trabajo, ciudad de trabajo, país de trabajo, teléfono de trabajo, estado de trabajo y zip de trabajo) del archivo /addrbook.ghp, lo que permite a un atacante inyectar un payload de JavaScript. especialmente manipulado para ejecutarse cuando la aplicación está cargada

Easy Address Book Web Server version 1.6 suffers from buffer overflow and cross site scripting vulnerabilities.

*Credits: Rafael Pedrero
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-08-23 CVE Reserved
  • 2023-08-31 CVE Published
  • 2024-09-05 CVE Updated
  • 2024-10-10 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
  • CAPEC-63: Cross-Site Scripting (XSS)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Easy Address Book Web Server Project
Search vendor "Easy Address Book Web Server Project"
Easy Address Book Web Server
Search vendor "Easy Address Book Web Server Project" for product "Easy Address Book Web Server"
1.6
Search vendor "Easy Address Book Web Server Project" for product "Easy Address Book Web Server" and version "1.6"
-
Affected