CVE-2023-23849

{"id": "CVE-2023-23849", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2023-02-06T23:15:10.067", "references": [{"url": "https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-CVE-2023-23849-affecting-Coverity", "tags": ["Vendor Advisory"], "source": "disclosure@synopsys.com"}, {"url": "https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-CVE-2023-23849-affecting-Coverity", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "disclosure@synopsys.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole subdomain which can be used to bypass other mitigations in place for malicious purposes. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/RL:O/RC:C"}, {"lang": "es", "value": "Las versiones de Coverity Connect anteriores a 2022.12.0 se ven afectadas por una vulnerabilidad de cross-site scripting no autenticadas. Cualquier servicio web alojado en el mismo subdominio puede configurar una cookie para todo el subdominio que puede usarse para evitar otras mitigaciones implementadas con fines maliciosos. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/RL:O/RC:C"}], "lastModified": "2024-11-21T07:46:57.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:synopsys:coverity:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "332F5E1D-49AD-4A7E-B5E5-F91E17E690D5", "versionEndExcluding": "2022.12.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@synopsys.com"}