{"id":"CVE-2023-7238","state":"PUBLISHED","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer","description":"\nA XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.\n\n","publishedAt":"2024-01-23T19:20:02.324Z","updatedAt":"2025-06-17T21:19:26.897Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"icscert"},"assigner":"icscert","products":["Orthanc Osimis DICOM Web Viewer"],"affected":[{"vendor":"Orthanc","product":"Osimis DICOM Web Viewer","defaultStatus":"unaffected","versions":[{"version":"1.4.2.0-9d9eff4","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/7xxx/CVE-2023-7238.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-7238","state":"PUBLISHED","datePublished":"2024-01-23T19:20:02.324Z","dateUpdated":"2025-06-17T21:19:26.897Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2024-01-22T16:41:11.753Z"},"containers":{"cna":{"title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer","descriptions":[{"lang":"en","value":"\nA XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.\n\n"}],"affected":[{"vendor":"Orthanc","product":"Osimis DICOM Web Viewer","defaultStatus":"unaffected","versions":[{"version":"1.4.2.0-9d9eff4","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2024-01-23T19:20:02.324Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Noam Moshe of Claroty Team82"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"\n\n<p>Orthanc recommends users mitigate this vulnerability by updating to the Docker images and Windows installers to Orthanc version 24.1.2 or greater.</p><p>Review Orthanc's <a target=\"_blank\" rel=\"nofollow\" href=\"https://discourse.orthanc-server.org/t/osimis-web-viewer-1-4-3/4206\">security bullentin</a>&nbsp;for more details.</p>\n\n<br>"}],"value":"\nOrthanc recommends users mitigate this vulnerability by updating to the Docker images and Windows installers to Orthanc version 24.1.2 or greater.\n\nReview Orthanc's  security bullentin https://discourse.orthanc-server.org/t/osimis-web-viewer-1-4-3/4206  for more details.\n\n\n\n\n"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01","tags":["government-resource","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T08:57:35.227Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-7238","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2024-01-24T15:37:12.921629Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-17T21:19:26.897Z"}}]}}}