CVE-2023-24065

Katalog CVE

CVSS 5.4 · Medium EPSS 0,57%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada nosh chartingsystem project nosh chartingsystem. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for health charting.

Rincian

Terbit di NVD

29 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/abbisQQ/e0967d5b8355087c8e224bdd1ace3bf3 advisory pihak ketiga
• https://github.com/shihjay2/docker-nosh advisory pihak ketiga
• https://github.com/shihjay2/nosh2/issues/202 exploit · advisory pihak ketiga
• https://github.com/shihjay2/nosh2/tree/4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533 advisory pihak ketiga
• https://noshemr.wordpress.com product · advisory pihak ketiga