CVE-2023-32193

Published: Oct 16, 2024Modified: Jun 17, 2026Deferred

8.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Exploitability: 2.8 / Impact: 5.5

Source: meissner@suse.de (Secondary)

Description

A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.

Related CWEs

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

References (2)

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32193

Source: meissner@suse.de

https://github.com/rancher/norman/security/advisories/GHSA-r8f4-hv23-6qp6

Source: meissner@suse.de

Timeline

No history available yet.