CVE-2023-29014 Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter
An attacker can execute malicious scripts in a user's browser via a crafted link exploiting the LOGID parameter in Goobi viewer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-29014?
CVE-2023-29014 is a medium-severity cross-site scripting vulnerability in intranda goobi-viewer-core, published on 6 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. The vulnerability has been fixed in version 23.03.
Weakness: CWE-79
Which versions are affected by CVE-2023-29014?
2 open source packages ship an affected version, including io.goobi.viewer:viewer-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.goobi.viewer:viewer-core Maven | All versions | 23.03 |
io.goobi.viewer:viewer-core Maven | All versions | 23.03 |
Products include Intranda Goobi Viewer Core.
How do I fix CVE-2023-29014?
Upgrade io.goobi.viewer:viewer-core to 23.03 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-29014 being exploited?
There is no known exploitation of CVE-2023-29014 in the wild and no public exploit code.
Other vulnerabilities in intranda goobi-viewer-core
Sources
Also known as GHSA-7v7g-9vx6-vcg2.