CVE-2023-29016 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames
An attacker can inject malicious scripts via user nicknames, leading to script execution in victims' browsers when viewing profiles.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-29016?
CVE-2023-29016 is a medium-severity cross-site scripting vulnerability in intranda goobi-viewer-core, published on 6 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when using nicknames. An attacker could create a user account and enter malicious scripts into their profile's nickname, resulting in the execution in the user's browser when displaying the nickname on certain pages. The vulnerability has been fixed in version 23.03.
Weakness: CWE-79
Which versions are affected by CVE-2023-29016?
2 open source packages ship an affected version, including io.goobi.viewer:viewer-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.goobi.viewer:viewer-core Maven | All versions | 23.03 |
io.goobi.viewer:viewer-core Maven | All versions | 23.03 |
Products include Intranda Goobi Viewer Core.
How do I fix CVE-2023-29016?
Upgrade io.goobi.viewer:viewer-core to 23.03 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-29016 being exploited?
There is no known exploitation of CVE-2023-29016 in the wild and no public exploit code.
Other vulnerabilities in intranda goobi-viewer-core
Sources
Also known as GHSA-2r9r-8fcg-m38g.