What is CVE-2023-3481?

CVE-2023-3481 is a medium-severity vulnerability in Google Critters, classified under Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). CVSS score: 5.7/10. Published 2023-08-21.

How severe is CVE-2023-3481?

Medium severity. CVSS v3 base score is 5.7 out of 10.

XSS in Google Critters

CVE-2023-3481

Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension.

EPSS: 0.001 (4.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N.

Affected products

Google Critters
Google Chrome Labs Critters — versions 0.0.17

Weakness classification (CWE)

CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-116 — Improper Encoding or Escaping of Output
CWE-79 — Cross-site Scripting

References

cve-coordination@google.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-3481?: CVE-2023-3481 is a medium-severity vulnerability in Google Critters, classified under Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). CVSS score: 5.7/10. Published 2023-08-21.
How severe is CVE-2023-3481?: Medium severity. CVSS v3 base score is 5.7 out of 10.