CVE-2024-23889

Cross-Site Scripting (XSS) vulnerability in Cups Easy

Severity Score

6.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/itemgroupcreate.php, in the itemgroupid parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.

Se ha informado de una vulnerabilidad en Cups Easy (Purchase & Inventory), versión 1.0, por la cual las entradas controladas por el usuario no están suficientemente codificadas, lo que genera una vulnerabilidad de cross site scripting (XSS) a través de /cupseasylive/itemgroupcreate.php, en el parámetro itemgroupid . La explotación de esta vulnerabilidad podría permitir a un atacante remoto enviar una URL especialmente manipulada a un usuario autenticado y robar sus credenciales de cookies de sesión.

*Credits: Rafael Pedrero

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2024-01-23 CVE Reserved
2024-01-26 CVE Published
2024-01-31 EPSS Updated
2024-08-01 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (1)

URL	Tag	Source
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Ajaysharma Search vendor "Ajaysharma"		Cups Easy Search vendor "Ajaysharma" for product "Cups Easy"				1.0 Search vendor "Ajaysharma" for product "Cups Easy" and version "1.0"		-		Affected