CVE-2023-50072

CVSS 3.1 Score 5.4 of 10 (medium)

Details

Published Jan 13, 2024
Updated: Jan 19, 2024
CWE ID 79

Summary

CVE-2023-50072 is a Stored Cross-Site Scripting (XSS) vulnerability that affects OpenKM version 7.1.40 (dbb6e88) with Professional Extension. An authenticated user can upload a note on a file, which serves as a stored XSS payload. When any user opens the note of a document file, the XSS is triggered. The vulnerability has a base severity of MEDIUM and requires low privileges and user interaction to exploit. It has an exploitability score of 2.3 and an impact score of 2.7. The potential danger it poses to an organization includes potential unauthorized access, data leakage, and potential manipulation of sensitive information through malicious scripts injected by attackers. To remediate the vulnerability, users should update their OpenKM software to a version that addresses this issue or apply any patches provided by the vendor.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-50072 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options