CVE-2023-5378 - OpenCVE

Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2. MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Megabip	Megabip
Smod	Smodbip

Configuration 1 [-]

OR	cpe:2.3:a:megabip:megabip::::::::
	cpe:2.3:a:smod:smodbip::::::::

No data.

References

Link	Providers
https://cert.pl/en/posts/2023/12/CVE-2023-5378
https://cert.pl/posts/2023/12/CVE-2023-5378
https://megabip.pl/
https://smod.pl/

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published: 2024-01-29T11:11:11.608Z

Updated: 2024-08-02T07:59:44.420Z

Reserved: 2023-10-04T10:45:50.683Z

Link: CVE-2023-5378

Vulnrichment

No data.

NVD

Status : Modified

Published: 2024-01-29T12:15:07.860

Modified: 2024-02-19T12:15:43.980

Link: CVE-2023-5378

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5378", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2023-10-04T10:45:50.683Z", "datePublished": "2024-01-29T11:11:11.608Z", "dateUpdated": "2024-08-02T07:59:44.420Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "MegaBIP", "repo": "https://megabip.pl/pobierz/1", "vendor": "Jan Syski", "versions": [{"lessThanOrEqual": "4.36.2", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "*", "status": "unaffected", "version": "5.08", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "SmodBIP", "repo": "https://smod.pl/pliki/smodbip221.zip", "vendor": "Jan Syski", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "datePublic": "2024-01-12T09:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.<p>This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2. <span style=\"background-color: rgb(255, 255, 255);\">MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown.</span><br></p>"}], "value": "Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2.\u00a0MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown.\n\n\n"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2024-02-19T11:56:08.907Z"}, "references": [{"tags": ["product"], "url": "https://megabip.pl/"}, {"tags": ["product"], "url": "https://smod.pl/"}, {"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2023/12/CVE-2023-5378"}, {"tags": ["third-party-advisory"], "url": "https://cert.pl/posts/2023/12/CVE-2023-5378"}], "source": {"discovery": "UNKNOWN"}, "title": "Stored XSS in SmodBIP and MegaBIP", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:59:44.420Z"}, "title": "CVE Program Container", "references": [{"tags": ["product", "x_transferred"], "url": "https://megabip.pl/"}, {"tags": ["product", "x_transferred"], "url": "https://smod.pl/"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://cert.pl/en/posts/2023/12/CVE-2023-5378"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://cert.pl/posts/2023/12/CVE-2023-5378"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:megabip:megabip:*:*:*:*:*:*:*:*", "matchCriteriaId": "A61E360F-A37C-4E94-AA77-340F36667E38", "versionEndIncluding": "4.36.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:smod:smodbip:*:*:*:*:*:*:*:*", "matchCriteriaId": "E866378A-BD50-4001-9F9F-190B09F9DEAE", "versionEndIncluding": "2.21", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2.\u00a0MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown.\n\n\n"}, {"lang": "es", "value": "Vulnerabilidad de validaci\u00f3n de entrada incorrecta en MegaBIP y el software SmodBIP que ya no es compatible permite almacenar XSS. Este problema afecta a SmodBIP en todas las versiones y a MegaBIP en versiones hasta 4.36.2 (las versiones m\u00e1s recientes no se probaron; el proveedor no ha confirmado que solucione la vulnerabilidad)."}], "id": "CVE-2023-5378", "lastModified": "2024-02-19T12:15:43.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "cvd@cert.pl", "type": "Secondary"}]}, "published": "2024-01-29T12:15:07.860", "references": [{"source": "cvd@cert.pl", "tags": ["Third Party Advisory"], "url": "https://cert.pl/en/posts/2023/12/CVE-2023-5378"}, {"source": "cvd@cert.pl", "tags": ["Third Party Advisory"], "url": "https://cert.pl/posts/2023/12/CVE-2023-5378"}, {"source": "cvd@cert.pl", "tags": ["Product"], "url": "https://megabip.pl/"}, {"source": "cvd@cert.pl", "tags": ["Product"], "url": "https://smod.pl/"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "cvd@cert.pl", "type": "Secondary"}]}