CVE-2023-32193 Norman API Cross-site Scripting Vulnerability
Unauthenticated cross-site scripting in Norman's public API allows attackers to execute JavaScript and remote commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-32193?
CVE-2023-32193 is a high-severity cross-site scripting vulnerability in SUSE norman, published on 16 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.
Weakness: CWE-80
Which versions are affected by CVE-2023-32193?
3 open source packages ship an affected version, including github.com/rancher/norman.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rancher/norman Go | All versions | 0.0.0-20240207153100-3bb70b772b52 |
github.com/rancher/norman Go | All versions | 0.0.0-20240207153100-3bb70b772b52 |
github.com/rancher/norman Go | All versions | 0.0.0-20240207153100-3bb70b772b52 |
How do I fix CVE-2023-32193?
Upgrade github.com/rancher/norman to 0.0.0-20240207153100-3bb70b772b52 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-32193 being exploited?
There is no known exploitation of CVE-2023-32193 in the wild and no public exploit code.
Sources
Also known as GHSA-r8f4-hv23-6qp6, GO-2024-2536.