CVE-2023-45757

Published: Oct 16, 2023Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the builtin rpcz page. Solution (choose one of three): 1. upgrade to bRPC > 1.6.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.6.1/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2411 3. disable rpcz feature

Affected (1)

Products: Apache: Brpc

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Brpc	Before 1.6.1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

http://www.openwall.com/lists/oss-security/2023/10/16/8

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread/6syxv32fqgl30brfpttrk4rfsb983hl4

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2023/10/16/8

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.apache.org/thread/6syxv32fqgl30brfpttrk4rfsb983hl4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.