{"id":"CVE-2023-5378","state":"PUBLISHED","title":"Stored XSS in SmodBIP and MegaBIP","description":"Improper Input Validation vulnerability in  MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2. MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown.","publishedAt":"2024-01-29T11:11:11.608Z","updatedAt":"2025-06-17T21:29:17.036Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"CERT-PL"},"assigner":"CERT-PL","products":["Jan Syski MegaBIP","Jan Syski SmodBIP"],"affected":[{"vendor":"Jan Syski","product":"MegaBIP","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.36.2","versionType":"semver"},{"version":"5.08","status":"unaffected","lessThan":"*","versionType":"semver"}],"repo":"https://megabip.pl/pobierz/1"},{"vendor":"Jan Syski","product":"SmodBIP","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}],"repo":"https://smod.pl/pliki/smodbip221.zip"}],"references":["https://megabip.pl/","https://smod.pl/","https://cert.pl/en/posts/2023/12/CVE-2023-5378","https://cert.pl/posts/2023/12/CVE-2023-5378"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/5xxx/CVE-2023-5378.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-5378","state":"PUBLISHED","datePublished":"2024-01-29T11:11:11.608Z","dateUpdated":"2025-06-17T21:29:17.036Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2023-10-04T10:45:50.683Z"},"containers":{"cna":{"title":"Stored XSS in SmodBIP and MegaBIP","descriptions":[{"lang":"en","value":"Improper Input Validation vulnerability in  MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2. MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown."}],"affected":[{"vendor":"Jan Syski","product":"MegaBIP","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.36.2","versionType":"semver"},{"version":"5.08","status":"unaffected","lessThan":"*","versionType":"semver"}],"repo":"https://megabip.pl/pobierz/1"},{"vendor":"Jan Syski","product":"SmodBIP","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}],"repo":"https://smod.pl/pliki/smodbip221.zip"}],"references":[{"url":"https://megabip.pl/","tags":["product"]},{"url":"https://smod.pl/","tags":["product"]},{"url":"https://cert.pl/en/posts/2023/12/CVE-2023-5378","tags":["third-party-advisory"]},{"url":"https://cert.pl/posts/2023/12/CVE-2023-5378","tags":["third-party-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2024-10-10T15:36:09.436Z"},"datePublic":"2024-01-12T09:00:00.000Z","impacts":[{"capecId":"CAPEC-592","descriptions":[{"lang":"en","value":"CAPEC-592 Stored XSS"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://megabip.pl/","tags":["product","x_transferred"]},{"url":"https://smod.pl/","tags":["product","x_transferred"]},{"url":"https://cert.pl/en/posts/2023/12/CVE-2023-5378","tags":["third-party-advisory","x_transferred"]},{"url":"https://cert.pl/posts/2023/12/CVE-2023-5378","tags":["third-party-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:59:44.420Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-5378","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2024-01-31T18:06:53.101425Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-17T21:29:17.036Z"}}]}}}