What is CVE-2023-31434?

CVE-2023-31434 is a medium-severity vulnerability in Evasys, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2023-05-02.

How severe is CVE-2023-31434?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Is CVE-2023-31434 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Evasys

CVE-2023-31434

The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 do not validate input, which allows authenticated attackers to inject HTML Code and XSS payloads in multiple locations.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.005 (38.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Evasys — versions 8.2, 9.0
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

cve@mitre.org (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2023-31434?: CVE-2023-31434 is a medium-severity vulnerability in Evasys, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2023-05-02.
How severe is CVE-2023-31434?: Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2023-31434 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.