Vulnerability Details : CVE-2023-0513
Potential exploit
A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.3 is able to address this issue. It is recommended to upgrade the affected component. VDB-219334 is the identifier assigned to this vulnerability.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2023-0513
- cpe:2.3:a:dreamer_cms_project:dreamer_cms:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-0513
0.29%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 51 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-0513
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:P/A:N |
8.0
|
2.9
|
VulDB | |
3.5
|
LOW | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
2.1
|
1.4
|
VulDB | |
3.5
|
LOW | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
2.1
|
1.4
|
VulDB | 2024-02-29 |
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
2.3
|
2.7
|
NIST |
CWE ids for CVE-2023-0513
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: cna@vuldb.com (Primary)
References for CVE-2023-0513
-
https://vuldb.com/?ctiid.219334
Permissions Required;Third Party Advisory
-
https://gitee.com/isoftforce/dreamer_cms/tree/Latest_Stable_Release_4.1.3
Dreamer CMS(梦想家CMS内容管理系统): Dreamer CMS 梦想家内容发布系统采用流行的SpringBoot搭建,支持静态化、标签化建站。不需要专业的后台开发技能,会HTML就能建站,上手超简单;只需使用系统提供的标签就能轻松建设网站。全面支持各类表单字段,真正实现“0”代码建网站。 - GiteeProduct;Third Party Advisory
-
https://gitee.com/isoftforce/dreamer_cms/issues/I68UYM
存在存储型xss及未授权访问漏洞 · Issue #I68UYM · 王俊南/Dreamer CMS(梦想家CMS内容管理系统) - GiteeExploit;Issue Tracking;Third Party Advisory
-
https://vuldb.com/?id.219334
Permissions Required;Third Party Advisory
Jump to