CVE-2023-32193 - Vulnerability Details - OpenCVE

A vulnerability has been identified in which unauthenticated cross-site
scripting (XSS) in Norman's public API endpoint can be exploited. This
can lead to an attacker exploiting the vulnerability to trigger
JavaScript code and execute commands remotely.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0011.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Rancher	Norman

No data.

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32193
https://github.com/rancher/norman/security/advisories/GHSA-r8f4-hv23-6qp6

History

Sat, 12 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00072}`	epss `{'score': 0.0008}`

Wed, 16 Oct 2024 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Rancher Rancher norman
CPEs		cpe:2.3:a:rancher:norman::::::::
Vendors & Products		Rancher Rancher norman
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 16 Oct 2024 12:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.
Title		Norman API Cross-site Scripting Vulnerability
Weaknesses		CWE-80
References		https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32193 https://github.com/rancher/norman/security/advisories/GHSA-r8f4-hv23-6qp6
Metrics		cvssV3_1 `{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: suse

Published: 2024-10-16T12:27:13.591Z

Updated: 2024-10-16T16:23:57.223Z

Reserved: 2023-05-04T08:30:59.322Z

Link: CVE-2023-32193

Vulnrichment

Updated: 2024-10-16T16:23:46.557Z

NVD

Status : Awaiting Analysis

Published: 2024-10-16T13:15:12.540

Modified: 2024-10-16T16:38:14.557

Link: CVE-2023-32193

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32193", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2023-05-04T08:30:59.322Z", "datePublished": "2024-10-16T12:27:13.591Z", "dateUpdated": "2024-10-16T16:23:57.223Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "github.com/rancher/norman", "product": "norman", "vendor": "SUSE", "versions": [{"lessThan": "0.0.0-20240207153100-3bb70b772b52", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "https://github.com/diego95root"}, {"lang": "en", "type": "finder", "value": "https://github.com/kujalamathias"}], "datePublic": "2024-02-08T17:46:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability has been identified in which unauthenticated cross-site \nscripting (XSS) in Norman's public API endpoint can be exploited. This \ncan lead to an attacker exploiting the vulnerability to trigger \nJavaScript code and execute commands remotely.<br>"}], "value": "A vulnerability has been identified in which unauthenticated cross-site \nscripting (XSS) in Norman's public API endpoint can be exploited. This \ncan lead to an attacker exploiting the vulnerability to trigger \nJavaScript code and execute commands remotely."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2024-10-16T12:27:13.591Z"}, "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32193"}, {"url": "https://github.com/rancher/norman/security/advisories/GHSA-r8f4-hv23-6qp6"}], "source": {"discovery": "EXTERNAL"}, "title": "Norman API Cross-site Scripting Vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "rancher", "product": "norman", "cpes": ["cpe:2.3:a:rancher:norman:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "0.0.0-20240207153100-3bb70b772b52", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-16T15:55:36.386774Z", "id": "CVE-2023-32193", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-16T16:23:57.223Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32193", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-16T15:55:36.386774Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:rancher:norman:*:*:*:*:*:*:*:*"], "vendor": "rancher", "product": "norman", "versions": [{"status": "affected", "version": "0", "lessThan": "0.0.0-20240207153100-3bb70b772b52", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-16T16:23:46.557Z"}}], "cna": {"title": "Norman API Cross-site Scripting Vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "https://github.com/diego95root"}, {"lang": "en", "type": "finder", "value": "https://github.com/kujalamathias"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SUSE", "product": "norman", "versions": [{"status": "affected", "version": "0", "lessThan": "0.0.0-20240207153100-3bb70b772b52", "versionType": "semver"}], "packageName": "github.com/rancher/norman", "defaultStatus": "unaffected"}], "datePublic": "2024-02-08T17:46:00.000Z", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32193"}, {"url": "https://github.com/rancher/norman/security/advisories/GHSA-r8f4-hv23-6qp6"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in which unauthenticated cross-site \nscripting (XSS) in Norman's public API endpoint can be exploited. This \ncan lead to an attacker exploiting the vulnerability to trigger \nJavaScript code and execute commands remotely.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability has been identified in which unauthenticated cross-site \nscripting (XSS) in Norman's public API endpoint can be exploited. This \ncan lead to an attacker exploiting the vulnerability to trigger \nJavaScript code and execute commands remotely.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2024-10-16T12:27:13.591Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32193", "state": "PUBLISHED", "dateUpdated": "2024-10-16T16:23:57.223Z", "dateReserved": "2023-05-04T08:30:59.322Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2024-10-16T12:27:13.591Z", "assignerShortName": "suse"}, "dataVersion": "5.1"}