CVE-2023-29015 - Vulnerability Details - OpenCVE

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. The vulnerability has been fixed in version 23.03.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Intranda	Goobi Viewer Core

Configuration 1 [-]

cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256
https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h

History

Mon, 10 Feb 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-04-06T19:03:23.713Z

Updated: 2025-02-10T16:11:59.823Z

Reserved: 2023-03-29T17:39:16.143Z

Link: CVE-2023-29015

Vulnrichment

Updated: 2024-08-02T14:00:14.382Z

NVD

Status : Modified

Published: 2023-04-06T20:15:08.613

Modified: 2024-11-21T07:56:23.910

Link: CVE-2023-29015

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-29015", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-03-29T17:39:16.143Z", "datePublished": "2023-04-06T19:03:23.713Z", "dateUpdated": "2025-02-10T16:11:59.823Z"}, "containers": {"cna": {"title": "Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments ", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h"}, {"name": "https://github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256", "tags": ["x_refsource_MISC"], "url": "https://github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256"}], "affected": [{"vendor": "intranda", "product": "goobi-viewer-core", "versions": [{"version": "< 23.03", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-06T19:03:23.713Z"}, "descriptions": [{"lang": "en", "value": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. The vulnerability has been fixed in version 23.03."}], "source": {"advisory": "GHSA-622w-995c-3c3h", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:00:14.382Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h"}, {"name": "https://github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-10T16:11:53.838013Z", "id": "CVE-2023-29015", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T16:11:59.823Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h", "name": "https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256", "name": "https://github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:00:14.382Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-29015", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-10T16:11:53.838013Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T16:11:41.616Z"}}], "cna": {"title": "Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments ", "source": {"advisory": "GHSA-622w-995c-3c3h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "intranda", "product": "goobi-viewer-core", "versions": [{"status": "affected", "version": "< 23.03"}]}], "references": [{"url": "https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h", "name": "https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256", "name": "https://github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. The vulnerability has been fixed in version 23.03."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-06T19:03:23.713Z"}}}, "cveMetadata": {"cveId": "CVE-2023-29015", "state": "PUBLISHED", "dateUpdated": "2025-02-10T16:11:59.823Z", "dateReserved": "2023-03-29T17:39:16.143Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-04-06T19:03:23.713Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8174D86-7F9F-4ADD-85CA-16EB572F1F26", "versionEndExcluding": "23.03", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. The vulnerability has been fixed in version 23.03."}], "id": "CVE-2023-29015", "lastModified": "2024-11-21T07:56:23.910", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-04-06T20:15:08.613", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}