CVE-2023-49277
CVSS 3.1 Score 8.3 of 10 (high)
Details
Summary
CVE-2023-49277 is a security vulnerability affecting dpaste, an open-source pastebin application written in Python using the Django framework. The vulnerability resides in the expires parameter of the dpaste API and can be exploited through a POST Reflected XSS attack. This allows an attacker to execute arbitrary JavaScript code within a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. To remediate this vulnerability, users are advised to upgrade to dpaste release v3.8 or later versions as older versions are susceptible. No known workarounds exist, and applying the patch is the recommended solution. The vulnerability has a base severity of HIGH and an exploitability score of 2.8 out of 10. It poses a potential threat to organizations as it allows for remote execution of malicious code with elevated privileges.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions