Skip to content
CVE PROGRAM SOURCE RECORD2.1 Low

CVE-2023-42431

Potential XSS on user preferences page

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HW

Description

Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Hallo Welt! GmbH BlueSpice

Default version status: affected

  • 4 to ≤ 4.3.2affected
  • 3 to ≤ 3.2.10affected

References