CVE-2023-1572 DataGear Plugin cross site scripting

What is CVE-2023-1572?

CVE-2023-1572 is a low-severity cross-site scripting vulnerability in DataGear, published on 22 Mar 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A vulnerability has been found in DataGear up to 1.11.1 and classified as problematic. This vulnerability affects unknown code of the component Plugin Handler. The manipulation leads to cross site scripting. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.12.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223564.

Weakness: CWE-79

Which versions are affected by CVE-2023-1572?

It affects 1 product.

Products include Datagear Datagear.

How do I fix CVE-2023-1572?

No fix has been published for CVE-2023-1572 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-1572 being exploited?

There is no known exploitation of CVE-2023-1572 in the wild and no public exploit code.

Other vulnerabilities in DataGear

• CVE-2024-37759 Code injection in n/a Critical 9.8
• CVE-2025-65792 Path traversal in n/a Critical 9.1
• CVE-2023-1571 DataGear pagingQueryData sql injection Medium 6.3
• CVE-2023-7299 DataGear resolveSql sql injection Medium 5.3
• CVE-2024-7552 DataGear Data Schema Page ConversionSqlParamValueMapper.java evaluateVariableExpression expression language injection Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f792-rc34-g659.