// For flags

CVE-2023-4493

Easy Address Book Web Server Stored XSS vulnerability

Severity Score

5.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Stored Cross-Site Scripting in Easy Address Book Web Server 1.6 version, through the users_admin.ghp file that affects multiple parameters such as (firstname, homephone, lastname, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate, workzip). This vulnerability allows a remote attacker to store a malicious JavaScript payload in the application to be executed when the page is loaded, resulting in an integrity impact.

Cross-Site Scripting (XSS) en Easy Address Book Web Server versión 1.6, a través del archivo users_admin.ghp que afecta múltiples parámetros como (nombre, teléfono particular, apellido, apellido, segundo nombre, dirección de trabajo, ciudad de trabajo, país de trabajo, teléfono de trabajo, estado de trabajo, zip de trabajo). Esta vulnerabilidad permite a un atacante remoto almacenar un payload de JavaScript malicioso en la aplicación para ejecutarla cuando se carga la página, lo que afecta la integridad.

Easy Address Book Web Server version 1.6 suffers from buffer overflow and cross site scripting vulnerabilities.

*Credits: Rafael Pedrero
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-08-23 CVE Reserved
  • 2023-08-31 CVE Published
  • 2024-09-05 CVE Updated
  • 2024-10-10 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
  • CAPEC-63: Cross-Site Scripting (XSS)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Easy Address Book Web Server Project
Search vendor "Easy Address Book Web Server Project"
Easy Address Book Web Server
Search vendor "Easy Address Book Web Server Project" for product "Easy Address Book Web Server"
1.6
Search vendor "Easy Address Book Web Server Project" for product "Easy Address Book Web Server" and version "1.6"
-
Affected