Skip to content

Instantly share code, notes, and snippets.

@abbisQQ

abbisQQ/CVE-2023-24065.txt

Last active January 30, 2023 21:29
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save abbisQQ/e0967d5b8355087c8e224bdd1ace3bf3 to your computer and use it in GitHub Desktop.
Save abbisQQ/e0967d5b8355087c8e224bdd1ace3bf3 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2023-24065
Raw
CVE-2023-24065.txt
Stored XSS vulnerability in NOSH ChartingSystem version git-4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533 via the create user page.
[Description]
Nosh, as implemented in docker-nosh allows stored XSS via the
create user page. For example, a first name (of a physician,
assistant, or billing user) can have a JavaScript payload that is
executed upon visiting the /users/2/1 page.
Attempted to contact the vendor and have not received a response.
[Vulnerability Type]
Cross Site Scripting (XSS)
[Vendor of Product]
https://github.com/shihjay2/docker-nosh
[Affected Product Code Base]
NOSH ChartingSystem - Version git-4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533
[Affected Component]
The Create user functionality is vulnerable
[Attack Type]
Context-dependent
[CVE Impact Other]
Javascript code execution in users browser.
[Reference]
https://demo.noshchartingsystem.com/
https://noshemr.wordpress.com/
https://github.com/shihjay2/docker-nosh
https://github.com/shihjay2/nosh2/issues/202
# This vulnerability has a CVSS score of 4.3
# More information: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
[Discoverer]
Mr Charalampos Theodorou
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment