CVE-2023-32193

Norman API Cross-site Scripting Vulnerability

State: Published
Severity: 8.3 High
Published: Oct 16, 2024
Updated: Oct 16, 2024
Reserved: May 4, 2023

Description

A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L	suse

Weaknesses

CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page

Affected Products

Product	Versions
normanSUSE	before 0.0.0-20240207153100-3bb70b772b52Affected

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32193
https://github.com/rancher/norman/security/advisories/GHSA-r8f4-hv23-6qp6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.