CVE-2023-3971

Katalog CVE

CVSS 5.4 · Medium EPSS 0,81%

Kerentanan Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) pada redhat ansible automation controller, redhat ansible automation platform +2 lainnya. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

Rincian

Terbit di NVD

4 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2023:4340 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:4590 advisory vendor
• https://access.redhat.com/security/cve/CVE-2023-3971 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2226965 issue tracking · advisory vendor