CVE-2023-50069 Cross-site scripting in n/a
Stored XSS in WireMock GUI allows attackers to execute arbitrary scripts via malicious recording responses, impacting users viewing the Matched page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-50069?
CVE-2023-50069 is a medium-severity cross-site scripting vulnerability in n/a, published on 29 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. An attacker can host a malicious payload and perform a test mapping pointing to the attacker's file, and the result will render on the Matched page in the Body area, resulting in the execution of the payload. This occurs because the response body is not validated or sanitized.
Weakness: CWE-79
Which versions are affected by CVE-2023-50069?
1 open source package ship an affected version, including wiremock. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wiremock Bitnami | From 3.0.4 to 3.2.0 | None |
Products include Wiremock Wiremock.
How do I fix CVE-2023-50069?
No fix has been published for CVE-2023-50069 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-50069 being exploited?
There is no known exploitation of CVE-2023-50069 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as BIT-wiremock-2023-50069, GHSA-qhjx-8fqw-x3cm.