SecuriTricks - CVE-2023-50717

Description

NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack. This allows remote attacker to execute JavaScript code in the context of the user accessing the vector. An attacker could have used this vulnerability to execute requests in the name of a logged-in user or potentially collect information about the attacked user by displaying a malicious form. Version 0.202.10 contains a patch for the issue.

Product(s) Impacted

Product	Versions
NocoDB	0.202.6 before 0.202.10
NocoDB	0.202.6 - 0.202.10

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

https://github.com/nocodb/nocodb/security/advisories/GHSA-qg73-g3cf-vhhh

CVSS Score

5.7 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: NONE
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

View Vector String

Timeline

Published: May 14, 2024, 2:17 p.m.
Last Modified: May 14, 2024, 4:13 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

CVE-2023-50717