CVE-2023-29014: falha de média gravidade em intranda goobi-viewer-core
Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.4%
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. The vulnerability has been fixed in version 23.03.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
intranda · goobi-viewer-coreCVEs relacionadas — intranda goobi-viewer-core
No mesmo produto, das mais perigosas para as menos.
CVE-2020-15124CRITICALPath traversal in Goobi viewer CoreEPSS 1.5%CVE-2026-46652CRITICALPath traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewerEPSS 0.7%CVE-2023-29016MEDIUMGoobi viewer Core has Cross-Site Scripting Vulnerability in User NicknamesEPSS 0.4%CVE-2023-29015MEDIUMGoobi viewer Core has Cross-Site Scripting Vulnerability in User Comments EPSS 0.4%CVE-2026-45083CRITICALGoobi viewer: Unauthenticated Solr Streaming Expression ProxyEPSS 0.4%CVE-2026-46651CRITICALUnauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewerEPSS 0.4%