CVE-2023-37785
CVSS 3.1 Score 4.8 of 10 (medium)
Details
Summary
CVE-2023-37785 is a cross-site scripting (XSS) vulnerability that affects ImpressCMS versions 1.4.5 and earlier. Attackers can exploit this vulnerability by injecting a crafted payload into the smile_code parameter of the /editprofile.php component, allowing them to execute arbitrary web scripts or HTML. The vulnerability has a CVSS base score of 4.8, indicating a medium severity level. It requires high privileges and user interaction, with a low complexity attack vector through the network. The impact score is 2.7, with low integrity and confidentiality impact, and no availability impact. Affected products include fmOIGq, iVbwjx, QtrPwI, and many others. Organizations should remediate this vulnerability by updating to a version of ImpressCMS that is newer than 1.4.5 to mitigate the potential danger posed by attackers exploiting this XSS vulnerability for unauthorized script execution or manipulation of web content on affected systems.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions