CVE-2023-26042 - OpenCVE

Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Part-db Project	Part-db

Configuration 1 [-]

cpe:2.3:a:part-db_project:part-db:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099
https://github.com/Part-DB/Part-DB-server/pull/227
https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2
https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-02-27T14:41:24.145Z

Updated: 2024-08-02T11:39:06.446Z

Reserved: 2023-02-17T22:44:03.149Z

Link: CVE-2023-26042

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-02-27T15:15:11.753

Modified: 2023-03-07T17:30:44.930

Link: CVE-2023-26042

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-26042", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-02-17T22:44:03.149Z", "datePublished": "2023-02-27T14:41:24.145Z", "dateUpdated": "2024-08-02T11:39:06.446Z"}, "containers": {"cna": {"title": "HTML/XSS injection possibilities in Part-DB ", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x"}, {"name": "https://github.com/Part-DB/Part-DB-server/pull/227", "tags": ["x_refsource_MISC"], "url": "https://github.com/Part-DB/Part-DB-server/pull/227"}, {"name": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099", "tags": ["x_refsource_MISC"], "url": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099"}, {"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2"}], "affected": [{"vendor": "Part-DB", "product": "Part-DB-server", "versions": [{"version": "< 1.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-02-27T14:41:24.145Z"}, "descriptions": [{"lang": "en", "value": "Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later."}], "source": {"advisory": "GHSA-9pmh-gmxx-rg2x", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:39:06.446Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x"}, {"name": "https://github.com/Part-DB/Part-DB-server/pull/227", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Part-DB/Part-DB-server/pull/227"}, {"name": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099"}, {"name": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:part-db_project:part-db:*:*:*:*:*:*:*:*", "matchCriteriaId": "CFE67675-403E-49C9-99BE-E3B4B8BA3C18", "versionEndExcluding": "1.0.2", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later."}], "id": "CVE-2023-26042", "lastModified": "2023-03-07T17:30:44.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-02-27T15:15:11.753", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/Part-DB/Part-DB-server/pull/227"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}