CVE-2023-24278

MEDIUMNuclei

Squidex <7.4.0 - Cross-Site Scripting

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-24278 has a selected CVSS score of 6.1 (medium); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 26, 2025 · Source: CVE List

Proofs of concept

1

Repository PoCs

GitHubNeCr00/CVE-2023-24278Repository PoCby NeCr007Not analyzed1 file

2.0 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMSquidex <7.4.0 - Cross-Site ScriptingCVSS 6.1

Squidex before 7.4.0 contains a cross-site scripting vulnerability via the squid.svg endpoint. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to Squidex CMS version 7.4.0 or later to mitigate this vulnerability.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2023cvexsssquidexcmsunauthsquidex.iovuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:squidex.io:squidex:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:1099097618
FOFA: icon_hash=1099097618
https://census-labs.com/news/2023/03/16/reflected-xss-vulnerabilities-in-squidex-squidsvg-endpoint/ https://www.openwall.com/lists/oss-security/2023/03/16/1 https://nvd.nist.gov/vuln/detail/CVE-2023-24278 https://github.com/karimhabush/cyberowl

Source: ProjectDiscovery

References

3