Products
NocoDB
- 0.202.9 and prior
NocoDB
- 0.202.9 and before
Source
security-advisories@github.com
Tags
CVE-2023-49781 details
Last Modified : May 14, 2024, 4:13 p.m.
Description
NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink(). This function recognizes the pattern URI::(XXX) and creates a hyperlink tag <a> with href=XXX. However, it leaves all the other contents outside of the pattern URI::(XXX) unchanged. This vulnerability is fixed in 0.202.9.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7.3 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Base Score
7.3
Exploitability Score
Impact Score
Base Severity
HIGH
Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
References
| URL | Source |
|---|---|
| https://github.com/nocodb/nocodb/commit/7f58ce3726dfec71537d8b80474a0f95a48a1574 | security-advisories@github.com |
| https://github.com/nocodb/nocodb/security/advisories/GHSA-h6r4-xvw6-jc5h | security-advisories@github.com |