CVE-2023-3034 - OpenCVE

Reflected XSS affects the ‘mode’ parameter in the /admin functionality of the web application in versions <=2.0.44

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Bund	Bkg Professional Ntripcaster

Configuration 1 [-]

cpe:2.3:a:bund:bkg_professional_ntripcaster:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://igs.bkg.bund.de/ntrip/bkgcaster
https://igs.bkg.bund.de/root_ftp/NTRIP/software/NTRIPCASTER_CHANGELOG

History

No history.

MITRE

Status: PUBLISHED

Assigner: NCSC.ch

Published: 2023-06-28T08:09:04.348Z

Updated: 2024-08-02T06:41:04.227Z

Reserved: 2023-06-01T08:53:55.239Z

Link: CVE-2023-3034

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-06-28T09:15:09.677

Modified: 2023-07-06T18:04:10.673

Link: CVE-2023-3034

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-3034", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "state": "PUBLISHED", "assignerShortName": "NCSC.ch", "dateReserved": "2023-06-01T08:53:55.239Z", "datePublished": "2023-06-28T08:09:04.348Z", "dateUpdated": "2024-08-02T06:41:04.227Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "NTRIP Professional Caster", "vendor": "BKG", "versions": [{"status": "affected", "version": "<=2.0.44"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Muhammad Ashhab Khan, u-blox Red Team"}, {"lang": "en", "type": "sponsor", "user": "00000000-0000-4000-9000-000000000000", "value": "u-blox AG"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Reflected XSS affects the \u2018mode\u2019 parameter in the /admin functionality of the web application in versions <=2.0.44"}], "value": "Reflected XSS affects the \u2018mode\u2019 parameter in the /admin functionality of the web application in versions <=2.0.44"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2023-06-28T08:09:04.348Z"}, "references": [{"tags": ["product"], "url": "https://igs.bkg.bund.de/ntrip/bkgcaster"}, {"tags": ["vendor-advisory", "issue-tracking"], "url": "https://igs.bkg.bund.de/root_ftp/NTRIP/software/NTRIPCASTER_CHANGELOG"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to the latest version provided by BKG (NTRIP Caster 2.0.45 or later)<br>"}], "value": "Update to the latest version provided by BKG (NTRIP Caster 2.0.45 or later)\n"}], "source": {"discovery": "EXTERNAL"}, "title": "Reflected XSS in BKG Ntrip Professional Caster version <=2.0.44", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:41:04.227Z"}, "title": "CVE Program Container", "references": [{"tags": ["product", "x_transferred"], "url": "https://igs.bkg.bund.de/ntrip/bkgcaster"}, {"tags": ["vendor-advisory", "issue-tracking", "x_transferred"], "url": "https://igs.bkg.bund.de/root_ftp/NTRIP/software/NTRIPCASTER_CHANGELOG"}]}]}}