CVSS 3.1 Score 7.8 of 10 (high)


Published Nov 15, 2023
Updated: Nov 28, 2023


CVE-2023-48199 is an HTML Injection vulnerability in the 'manageApiKeys' component in Grocy version 4.0.3 and earlier. Attackers can exploit this vulnerability to inject arbitrary HTML content without script execution by manipulating user-supplied data through parameter values. The danger lies in the attacker being able to manipulate page content in the QR code detail popup, potentially using social engineering tactics and exploiting the trust of users, as well as the application's lack of proper input handling. The base severity rating for this vulnerability is HIGH, with a base score of 7.8, indicating a significant risk to organizations. It is recommended to update Grocy to a version that includes a fix for this issue to remediate the vulnerability.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-48199 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options