High – 7.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

PT-2023-14: Cross-site Scripting (XSS) in Anycomment.io

Error type:

  • CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Vulnerability vector:

  • Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
  • Severity (CVSSv3.1): 8.6 (high)
  • Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
  • Severity (CVSSv4.0): 7.7 (high)

Description:

The vulnerability was identified in Anycomment.io versions before 1.6.1.

The discovered vulnerability allows an attacker to inject code into a page processed by a user's browser, including JavaScript scripts.

Vulnerability status: Confirmed by vendor

Date of vulnerability remediation: 13.09.2023

Recommendations:

  • Update to version 1.6.1 or higher

Additional information: 

Researcher: Ilsaf Nabiullin (Positive Technologies)

Identifiers:

BDU:2023-08900

Vendor:

Anycomment

Vulnerable product:

Anycomment.io

Vulnerable versions:

< 1.6.1