CVE-2023-39683

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-39683
Cross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user input parameter(s). NOTE: Researcher claims issue is present in all versions prior and later than tested version.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/zalify/easy-email/issues/321 Issue Tracking
https://github.com/zalify/easy-email/issues/373 Issue Tracking
https://medium.com/%40vificatem/cve-2023-39683-dom-xss-on-json-source-code-panel-in-zalify-easy-email-3fa08f3e0d49 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:zalify:easy_email:*:*:*:*:*:node.js:*:*
History

30 Apr 2024, 20:16

Type Values Removed Values Added
CPE cpe:2.3:a:zalify:easy_email:*:*:*:*:*:*:*:* cpe:2.3:a:zalify:easy_email:*:*:*:*:*:node.js:*:*

15 Feb 2024, 19:25

Type Values Removed Values Added
First Time Zalify
Zalify easy Email
CPE cpe:2.3:a:zalify:easy_email:*:*:*:*:*:*:*:*
CWE CWE-79
References () https://github.com/zalify/easy-email/issues/321 - () https://github.com/zalify/easy-email/issues/321 - Issue Tracking
References () https://github.com/zalify/easy-email/issues/373 - () https://github.com/zalify/easy-email/issues/373 - Issue Tracking
References () https://medium.com/%40vificatem/cve-2023-39683-dom-xss-on-json-source-code-panel-in-zalify-easy-email-3fa08f3e0d49 - () https://medium.com/%40vificatem/cve-2023-39683-dom-xss-on-json-source-code-panel-in-zalify-easy-email-3fa08f3e0d49 - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

09 Feb 2024, 14:31

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de Cross Site Scripting (XSS) en EasyEmail v.4.12.2 y anteriores permite a un atacante local ejecutar código arbitrario a través de los parámetros de entrada del usuario. NOTA: El investigador afirma que el problema está presente en todas las versiones anteriores y posteriores a la versión probada.

09 Feb 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-09 07:15

Updated : 2024-04-30 20:16

NVD link : CVE-2023-39683

Mitre link : CVE-2023-39683

CVE.ORG link : CVE-2023-39683

JSON object : View

Products Affected

zalify

  • easy_email
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')