CVE-2023-48644

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-48644
An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feature of the maintenance module, via the description field. This allows an attacker to perform an action on behalf of the user, exfiltrate data, and so on.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48644
https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644 Third Party Advisory
https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:eptura:archibus:4.0.3:*:*:*:iphone_os:*:*:*
History

30 May 2025, 16:15

Type Values Removed Values Added
References
  • () https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48644 -

23 May 2025, 14:45

Type Values Removed Values Added
First Time Eptura
Eptura archibus
References () https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644 - () https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644 - Third Party Advisory
CPE cpe:2.3:a:eptura:archibus:4.0.3:*:*:*:iphone_os:*:*:*

21 Nov 2024, 08:32

Type Values Removed Values Added
References () https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644 - () https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644 -

19 Aug 2024, 18:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
CWE CWE-200

06 Mar 2024, 15:18

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema en la aplicación Archibus 4.0.3 para iOS. Existe una vulnerabilidad XSS en la función de creación de solicitud de trabajo del módulo de mantenimiento, a través del campo de descripción. Esto permite a un atacante realizar una acción en nombre del usuario, extraer datos, etc.

05 Mar 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-05 23:15

Updated : 2025-05-30 16:15

NVD link : CVE-2023-48644

Mitre link : CVE-2023-48644

CVE.ORG link : CVE-2023-48644

JSON object : View

Products Affected

eptura

  • archibus
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor