What is CVE-2023-31285?

CVE-2023-31285 is a medium-severity vulnerability in Serenity Serene, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2023-04-27.

How severe is CVE-2023-31285?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Serenity Serene

CVE-2023-31285

An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be sent to an administrator user.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.008 (52.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (Patch, Vendor Advisory)
cve@mitre.org (mailing-list)
cve@mitre.org

Frequently asked questions

What is CVE-2023-31285?: CVE-2023-31285 is a medium-severity vulnerability in Serenity Serene, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2023-04-27.
How severe is CVE-2023-31285?: Medium severity. CVSS v3 base score is 6.1 out of 10.