CVE-2023-7171
LOWNovel-Plus < 4.2.0 - Stored Cross-Site Scripting in Friendly Link Handler
Title source: llmDescription
A vulnerability was found in Novel-Plus up to 4.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file novel-admin/src/main/java/com/java2nb/novel/controller/FriendLinkController.java of the component Friendly Link Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named d6093d8182362422370d7eaf6c53afde9ee45215. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-249307.
References (4)
Core 4
Core References
Third Party Advisory vdb-entry
https://vuldb.com/?id.249307
Permissions Required, Third Party Advisory signature
permissions-required
https://vuldb.com/?ctiid.249307
Scores
CVSS v3
2.4
EPSS
0.0053
EPSS Percentile
40.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (1)
xxyopen/novel-plus
< 4.2.0
Published
Dec 29, 2023
Tracked Since
Feb 18, 2026