Vulnerability in Grocy Project
CVE-2023-48199
HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker can then manipulate page content in the QR code detail popup, often coupled with social engineering tactics, exploiting both the trust of users and the application's lack of proper input handling.
EPSS: 0.005 (40.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Grocy_project Grocy — versions 4.0.3
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Product)
- cve@mitre.org (Product)
- cve@mitre.org (Exploit, Third Party Advisory)
- cve@mitre.org
Frequently asked questions
- What is CVE-2023-48199?
- CVE-2023-48199 is a high-severity vulnerability in Grocy Project, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.8/10. Published 2023-11-15.
- How severe is CVE-2023-48199?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2023-48199 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.