A cross-site scripting vulnerability exists in Citadel versions prior to 994. When a malicious user sends an instant message with some JavaScript code, the script may be executed on the web browser of the victim user.
References
| Link | Resource |
|---|---|
| https://code.citadel.org/citadel/citadel | Product |
| https://code.citadel.org/citadel/citadel/-/commit/f0dac5ff074ad686fa71ea663c8ead107bd3041e | Patch Vendor Advisory |
| https://jvn.jp/en/jp/JVN08237727/ | Third Party Advisory |
| https://www.citadel.org/download.html | Product |
Configurations
History
10 Oct 2023, 13:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://jvn.jp/en/jp/JVN08237727/ - Third Party Advisory | |
| References | (MISC) https://code.citadel.org/citadel/citadel/-/commit/f0dac5ff074ad686fa71ea663c8ead107bd3041e - Patch, Vendor Advisory | |
| References | (MISC) https://code.citadel.org/citadel/citadel - Product | |
| References | (MISC) https://www.citadel.org/download.html - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CWE | CWE-79 | |
| CPE | cpe:2.3:a:citadel:citadel:*:*:*:*:*:*:*:* | |
| First Time |
Citadel citadel
Citadel |
04 Oct 2023, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-04 09:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-44272
Mitre link : CVE-2023-44272
CVE.ORG link : CVE-2023-44272
JSON object : View
Products Affected
citadel
- citadel
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')