CVE Vulnerability

CVE-2023-0549

A vulnerability, which was classified as problematic, has been found in YAFNET up to 3.1.10. This issue affects some unknown processing of the file /forum/PostPrivateMessage of the component Private Message Handler. The manipulation of the argument subject/message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.11 is able to address this issue. The name of the patch is 2237a9d552e258a43570bb478a92a5505e7c8797. It is recommended to upgrade the affected component. The identifier VDB-219665 was assigned to this vulnerability.

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/YAFNET/YAFNET/security/advisories/GHSA-4hwx-678w-9cp5 Exploit Third Party Advisory
https://github.com/YAFNET/YAFNET/releases/tag/v3.1.11 Release Notes Third Party Advisory
https://drive.google.com/drive/folders/1ct6Tp_cnsYO8L_JSvlBCf_Ae7KW3JAcD?usp=sharing Exploit Third Party Advisory
https://vuldb.com/?ctiid.219665 Third Party Advisory
https://github.com/YAFNET/YAFNET/commit/2237a9d552e258a43570bb478a92a5505e7c8797 Patch Third Party Advisory
https://vuldb.com/?id.219665 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:yetanotherforum:yaf.net:*:*:*:*:*:*:*:*
Information

Published : 2023-01-27 07:15

Updated : 2023-02-06 07:30

NVD link : CVE-2023-0549

Mitre link : CVE-2023-0549

Products Affected

Yetanotherforum

CWE
CWE-79