{"id":"CVE-2023-40153","state":"PUBLISHED","title":"Cross-site Scripting in DEXMA DEXGate","description":"\nThe affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary Java Script by injecting an XSS payload into the 'hostname' parameter of the vulnerable software.\n\n","publishedAt":"2023-10-19T18:05:42.988Z","updatedAt":"2024-09-11T20:09:53.916Z","severity":{"score":5.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"icscert"},"assigner":"icscert","products":["DEXMA DexGate"],"affected":[{"vendor":"DEXMA","product":"DexGate","defaultStatus":"unaffected","versions":[{"version":"20130114","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:06:17.512Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/40xxx/CVE-2023-40153.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-40153","state":"PUBLISHED","datePublished":"2023-10-19T18:05:42.988Z","dateUpdated":"2024-09-11T20:09:53.916Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2023-09-12T23:06:14.672Z"},"containers":{"cna":{"title":"Cross-site Scripting in DEXMA DEXGate","descriptions":[{"lang":"en","value":"\nThe affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary Java Script by injecting an XSS payload into the 'hostname' parameter of the vulnerable software.\n\n"}],"affected":[{"vendor":"DEXMA","product":"DexGate","defaultStatus":"unaffected","versions":[{"version":"20130114","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2023-10-19T18:05:42.988Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Aarón Flecha Menéndez of S21sec reported these vulnerabilities to CISA."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T18:24:55.597Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-11T20:07:09.086587Z","id":"CVE-2023-40153","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T20:09:53.916Z"}}]}}}