{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-4892", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "state": "PUBLISHED", "assignerShortName": "Fluid Attacks", "dateReserved": "2023-09-11T13:23:29.875Z", "datePublished": "2023-09-25T15:55:35.816Z", "dateUpdated": "2024-09-24T14:58:29.451Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "Teedy", "vendor": "Teedy", "versions": [{"status": "affected", "version": "1.11"}]}], "datePublic": "2023-09-25T15:53:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div>Teedy v1.11 has a vulnerability in its text editor that allows events</div><div>to be executed in HTML tags that an attacker could manipulate. Thanks</div><div>to this, it is possible to execute malicious JavaScript in the webapp.</div></div>"}], "value": "Teedy v1.11 has a vulnerability in its text editor that allows events\n\nto be executed in HTML tags that an attacker could manipulate. Thanks\n\nto this, it is possible to execute malicious JavaScript in the webapp.\n\n\n\n"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2023-09-25T15:55:35.816Z"}, "references": [{"url": "https://fluidattacks.com/advisories/freebird"}, {"url": "https://teedy.io"}], "source": {"discovery": "EXTERNAL"}, "title": "Teedy v1.11 - Stored cross-site scripting (XSS)", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:38:00.898Z"}, "title": "CVE Program Container", "references": [{"url": "https://fluidattacks.com/advisories/freebird", "tags": ["x_transferred"]}, {"url": "https://teedy.io", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-24T14:58:17.505740Z", "id": "CVE-2023-4892", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T14:58:29.451Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://fluidattacks.com/advisories/freebird", "tags": ["x_transferred"]}, {"url": "https://teedy.io", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:38:00.898Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-4892", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-24T14:58:17.505740Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T14:58:24.672Z"}}], "cna": {"title": "Teedy v1.11 - Stored cross-site scripting (XSS)", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Teedy", "product": "Teedy", "versions": [{"status": "affected", "version": "1.11"}], "platforms": ["MacOS"], "defaultStatus": "unaffected"}], "datePublic": "2023-09-25T15:53:00.000Z", "references": [{"url": "https://fluidattacks.com/advisories/freebird"}, {"url": "https://teedy.io"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Teedy v1.11 has a vulnerability in its text editor that allows events\n\nto be executed in HTML tags that an attacker could manipulate. Thanks\n\nto this, it is possible to execute malicious JavaScript in the webapp.\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "<div><div>Teedy v1.11 has a vulnerability in its text editor that allows events</div><div>to be executed in HTML tags that an attacker could manipulate. Thanks</div><div>to this, it is possible to execute malicious JavaScript in the webapp.</div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2023-09-25T15:55:35.816Z"}}}, "cveMetadata": {"cveId": "CVE-2023-4892", "state": "PUBLISHED", "dateUpdated": "2024-09-24T14:58:29.451Z", "dateReserved": "2023-09-11T13:23:29.875Z", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "datePublished": "2023-09-25T15:55:35.816Z", "assignerShortName": "Fluid Attacks"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sismics:teedy:1.11:*:*:*:*:*:*:*", "matchCriteriaId": "AB7008DF-9901-48D2-9079-D4F89F4E810E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Teedy v1.11 has a vulnerability in its text editor that allows events\n\nto be executed in HTML tags that an attacker could manipulate. Thanks\n\nto this, it is possible to execute malicious JavaScript in the webapp.\n\n\n\n"}, {"lang": "es", "value": "Teedy v1.11 tiene una vulnerabilidad en su editor de texto que permite ejecutar eventos en etiquetas HTML que un atacante podr\u00eda manipular. Gracias a esto, es posible ejecutar JavaScript malicioso en la aplicaci\u00f3n web.\n"}], "id": "CVE-2023-4892", "lastModified": "2023-09-26T18:59:31.087", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "help@fluidattacks.com", "type": "Secondary"}]}, "published": "2023-09-25T16:15:15.530", "references": [{"source": "help@fluidattacks.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://fluidattacks.com/advisories/freebird"}, {"source": "help@fluidattacks.com", "tags": ["Product"], "url": "https://teedy.io"}], "sourceIdentifier": "help@fluidattacks.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "help@fluidattacks.com", "type": "Secondary"}]}

{}