CVE-2023-5556

MEDIUMNuclei

Cross-site Scripting (XSS) - Reflected in structurizr/onpremises

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-5556 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 18, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

on-premises_installation

Browse structurizr / on-premises_installation

Default status: unknown

CVE ListBefore 3194affected

structurizr/onpremises

Browse structurizr / structurizr/onpremises
CVE ListBefore 3194affected

Nuclei templates

1
ProjectDiscoveryMEDIUMStructurizr on-premises - Cross Site ScriptingCVSS 6.1

Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.

Impact

Authenticated attackers can inject malicious JavaScript through the version parameter in workspace URLs to steal user session tokens and execute attacks against Structurizr users.

Remediation

Apply the latest security patches or updates provided by Structurizr to fix the XSS vulnerability.

WeaknessesCWE-79
Authorsshankaracharya
Template tagscvecve2023xssstructurizroosauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:structurizr:on-premises_installation:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:1199592666
FOFA: icon_hash=1199592666
https://huntr.com/bounties/a3ee0f98-6898-41ae-b1bd-242a03a73d1b/ https://github.com/structurizr/onpremises/commit/6cff4f792b010dfb1ff6a0b4ae1c6e398f8f8a18 https://github.com/fkie-cad/nvd-json-data-feeds

Source: ProjectDiscovery

References

3