CVE-2023-52240 Cross-site scripting in n/a
Cross-site scripting vulnerability in Kantega SSO plugin for Atlassian products allows attackers to execute scripts if SAML POST Binding is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-52240?
CVE-2023-52240 is a medium-severity cross-site scripting vulnerability in n/a, published on 29 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Kantega SAML SSO OIDC Kerberos Single Sign-on apps before 6.20.0 for Atlassian products allow XSS if SAML POST Binding is enabled. This affects 4.4.2 through 4.14.8 before 4.14.9, 5.0.0 through 5.11.4 before 5.11.5, and 6.0.0 through 6.19.0 before 6.20.0. The full product names are Kantega SAML SSO OIDC Kerberos Single Sign-on for Jira Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Confluence Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bitbucket Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bamboo Data Center & Server (Kantega SSO Enterprise), and Kantega SAML SSO OIDC Kerberos Single Sign-on for FeCru Server (Kantega SSO Enterprise). (Here, FeCru refers to the Atlassian Fisheye and Crucible products running together.)
Weakness: CWE-79
Which versions are affected by CVE-2023-52240?
It affects 1 product.
Products include Kantega-Sso Kantega Saml Sso Oidc Kerberos Single Sign-On.
How do I fix CVE-2023-52240?
No fix has been published for CVE-2023-52240 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-52240 being exploited?
There is no known exploitation of CVE-2023-52240 in the wild and no public exploit code.
Sources
Also known as GHSA-988m-998x-3cxx.