CVE-2023-36463 Cross site scripting (XSS) in meldekarten generator
Attackers can inject malicious scripts into text fields of the local registration card generator, potentially executing code in the victim's browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-36463?
CVE-2023-36463 is a medium-severity cross-site scripting vulnerability in jucktnich meldekarten-generator, published on 27 Jun 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Meldekarten generator is an open source project to create a program, running locally in the browser without the need for an internet-connection, to create, store and print registration cards for volunteers. All text fields on the webpage are vulnerable to XSS attacks. The user input isn't (fully) sanitized after submission. This issue has been addressed in commit `77e04f4af` which is included in the `1.0.0b1.1.2` release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2023-36463?
It affects 1 product.
Products include Meldekarten Generator Project Meldekarten Generator.
How do I fix CVE-2023-36463?
No fix has been published for CVE-2023-36463 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-36463 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36463 exists.
Sources
Also known as GHSA-f2gp-85cr-vgj7.