CVE-2023-29015 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments
An attacker can execute malicious scripts in a user's browser via crafted comments in the Goobi viewer web application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-29015?
CVE-2023-29015 is a medium-severity cross-site scripting vulnerability in intranda goobi-viewer-core, published on 6 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. The vulnerability has been fixed in version 23.03.
Weakness: CWE-79
Which versions are affected by CVE-2023-29015?
2 open source packages ship an affected version, including io.goobi.viewer:viewer-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.goobi.viewer:viewer-core Maven | All versions | 23.03 |
io.goobi.viewer:viewer-core Maven | All versions | 23.03 |
Products include Intranda Goobi Viewer Core.
How do I fix CVE-2023-29015?
Upgrade io.goobi.viewer:viewer-core to 23.03 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-29015 being exploited?
There is no known exploitation of CVE-2023-29015 in the wild and no public exploit code.
Other vulnerabilities in intranda goobi-viewer-core
Sources
Also known as GHSA-622w-995c-3c3h.