A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board (where they have BoardAdmin access), and renameAttachment does not block XSS payloads.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/172649/Wekan-6.74-Cross-Site-Scripting.html | Exploit Third Party Advisory VDB Entry |
| https://wekan.github.io/ | Product |
| https://wekan.github.io/hall-of-fame/filebleed/ | Exploit Vendor Advisory |
| http://packetstormsecurity.com/files/172649/Wekan-6.74-Cross-Site-Scripting.html | Exploit Third Party Advisory VDB Entry |
| https://wekan.github.io/ | Product |
| https://wekan.github.io/hall-of-fame/filebleed/ | Exploit Vendor Advisory |
Configurations
History
21 Nov 2024, 07:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/172649/Wekan-6.74-Cross-Site-Scripting.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://wekan.github.io/ - Product | |
| References | () https://wekan.github.io/hall-of-fame/filebleed/ - Exploit, Vendor Advisory |
Information
Published : 2023-06-26 16:15
Updated : 2024-11-21 07:55
NVD link : CVE-2023-28485
Mitre link : CVE-2023-28485
CVE.ORG link : CVE-2023-28485
JSON object : View
Products Affected
wekan_project
- wekan
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')