CVE-2023-5378

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-5378
Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2. MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://cert.pl/en/posts/2023/12/CVE-2023-5378 Third Party Advisory
https://cert.pl/posts/2023/12/CVE-2023-5378 Third Party Advisory
https://megabip.pl/ Product
https://smod.pl/ Product
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:megabip:megabip:*:*:*:*:*:*:*:*
cpe:2.3:a:smod:smodbip:*:*:*:*:*:*:*:*
History

19 Feb 2024, 12:15

Type Values Removed Values Added
Summary (en) Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2 (newer versions were not tested; the vendor has not confirmed fixing the vulnerability). (en) Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2. MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown.

02 Feb 2024, 02:06

Type Values Removed Values Added
CPE cpe:2.3:a:megabip:megabip:*:*:*:*:*:*:*:*
cpe:2.3:a:smod:smodbip:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 5.4
First Time Smod smodbip
Smod
Megabip megabip
Megabip
References () https://cert.pl/en/posts/2023/12/CVE-2023-5378 - () https://cert.pl/en/posts/2023/12/CVE-2023-5378 - Third Party Advisory
References () https://cert.pl/posts/2023/12/CVE-2023-5378 - () https://cert.pl/posts/2023/12/CVE-2023-5378 - Third Party Advisory
References () https://megabip.pl/ - () https://megabip.pl/ - Product
References () https://smod.pl/ - () https://smod.pl/ - Product
CWE CWE-79

29 Jan 2024, 14:25

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de validación de entrada incorrecta en MegaBIP y el software SmodBIP que ya no es compatible permite almacenar XSS. Este problema afecta a SmodBIP en todas las versiones y a MegaBIP en versiones hasta 4.36.2 (las versiones más recientes no se probaron; el proveedor no ha confirmado que solucione la vulnerabilidad).

29 Jan 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-29 12:15

Updated : 2024-02-19 12:15

NVD link : CVE-2023-5378

Mitre link : CVE-2023-5378

CVE.ORG link : CVE-2023-5378

JSON object : View

Products Affected

smod

  • smodbip

megabip

  • megabip
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-20

Improper Input Validation