CVE-2023-2220 - OpenCVE

A vulnerability was found in Dream Technology mica up to 3.0.5. It has been classified as problematic. Affected is an unknown function of the component Form Object Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-226986 is the identifier assigned to this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:S/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Dreamlu	Mica

Configuration 1 [-]

cpe:2.3:a:dreamlu:mica:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://gitee.com/596392912/mica/issues/I6TGJD
https://vuldb.com/?ctiid.226986
https://vuldb.com/?id.226986

History

No history.

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2023-04-21T11:31:03.118Z

Updated: 2024-08-02T06:12:20.671Z

Reserved: 2023-04-21T06:47:18.346Z

Link: CVE-2023-2220

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-04-21T12:15:07.533

Modified: 2024-05-17T02:22:46.857

Link: CVE-2023-2220

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-2220", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2023-04-21T06:47:18.346Z", "datePublished": "2023-04-21T11:31:03.118Z", "dateUpdated": "2024-08-02T06:12:20.671Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2023-10-22T14:53:47.360Z"}, "title": "Dream Technology mica Form Object cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Cross Site Scripting"}]}], "affected": [{"vendor": "Dream Technology", "product": "mica", "versions": [{"version": "3.0.0", "status": "affected"}, {"version": "3.0.1", "status": "affected"}, {"version": "3.0.2", "status": "affected"}, {"version": "3.0.3", "status": "affected"}, {"version": "3.0.4", "status": "affected"}, {"version": "3.0.5", "status": "affected"}], "modules": ["Form Object Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Dream Technology mica up to 3.0.5. It has been classified as problematic. Affected is an unknown function of the component Form Object Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-226986 is the identifier assigned to this vulnerability."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in Dream Technology mica bis 3.0.5 ausgemacht. Hiervon betroffen ist ein unbekannter Codeblock der Komponente Form Object Handler. Dank Manipulation mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N"}}], "timeline": [{"time": "2023-04-21T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2023-04-21T00:00:00.000Z", "lang": "en", "value": "CVE reserved"}, {"time": "2023-04-21T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2023-05-15T10:05:31.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "VulDB Gitee Analyzer", "type": "tool"}], "references": [{"url": "https://vuldb.com/?id.226986", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.226986", "tags": ["signature", "permissions-required"]}, {"url": "https://gitee.com/596392912/mica/issues/I6TGJD", "tags": ["issue-tracking"]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:12:20.671Z"}, "title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.226986", "tags": ["vdb-entry", "technical-description", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.226986", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://gitee.com/596392912/mica/issues/I6TGJD", "tags": ["issue-tracking", "x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dreamlu:mica:*:*:*:*:*:*:*:*", "matchCriteriaId": "B59BA6E7-5DD6-4D8F-B4FB-568E2CB3E60A", "versionEndIncluding": "3.0.5", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Dream Technology mica up to 3.0.5. It has been classified as problematic. Affected is an unknown function of the component Form Object Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-226986 is the identifier assigned to this vulnerability."}], "id": "CVE-2023-2220", "lastModified": "2024-05-17T02:22:46.857", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2023-04-21T12:15:07.533", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit"], "url": "https://gitee.com/596392912/mica/issues/I6TGJD"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?ctiid.226986"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.226986"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cna@vuldb.com", "type": "Primary"}]}