CVE-2023-48197

Summary

Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the "see QR code" function.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/grocy/grocy
• https://nitipoom-jar.github.io/CVE-2023-48197/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/grocy/grocy
• https://nitipoom-jar.github.io/CVE-2023-48197/
• https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48197

• ←Previous
• Next→