{"id":"CVE-2023-4090","state":"PUBLISHED","title":"Cross-Site Scripting (XSS) vulnerability on WideStand CMS of Acilia","description":"Cross-site Scripting (XSS) reflected vulnerability on WideStand until 5.3.5 version, which generates one of the meta tags directly using the content of the queried URL, which would allow an attacker to inject HTML/Javascript code into the response.","publishedAt":"2023-10-04T11:02:48.227Z","updatedAt":"2024-09-05T18:12:02.261Z","severity":{"score":5.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","source":"INCIBE"},"assigner":"INCIBE","products":["Acilia  Widestand CMS"],"affected":[{"vendor":"Acilia ","product":"Widestand CMS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.3.5","versionType":"custom"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-widestand-cms-acilia"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/4xxx/CVE-2023-4090.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-4090","state":"PUBLISHED","datePublished":"2023-10-04T11:02:48.227Z","dateUpdated":"2024-09-05T18:12:02.261Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2023-08-02T07:38:03.977Z"},"containers":{"cna":{"title":"Cross-Site Scripting (XSS) vulnerability on WideStand CMS of Acilia","descriptions":[{"lang":"en","value":"Cross-site Scripting (XSS) reflected vulnerability on WideStand until 5.3.5 version, which generates one of the meta tags directly using the content of the queried URL, which would allow an attacker to inject HTML/Javascript code into the response."}],"affected":[{"vendor":"Acilia ","product":"Widestand CMS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.3.5","versionType":"custom"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-widestand-cms-acilia"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2023-10-04T11:02:48.227Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Ángel Heredia Pérez"}],"datePublic":"2023-08-02T10:00:00.000Z","impacts":[{"capecId":"CAPEC-63","descriptions":[{"lang":"en","value":"CAPEC-63: Cross-Site Scripting (XSS)"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-widestand-cms-acilia","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:17:12.131Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-05T17:58:45.464589Z","id":"CVE-2023-4090","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-05T18:12:02.261Z"}}]}}}