Vulnerability · Published May 13, 2024 · Assigned by GitHub_M
CVE-2023-50717NocoDB Allows Preview of File with Dangerous Content
Medium 5.7
In plain English
A medium-severity unrestricted file upload in nocodb from nocodb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack. This allows remote attacker to execute JavaScript code in the context of the user accessing the vector. An attacker could have used this vulnerability to execute requests in the name of a logged-in user or potentially collect information about the attacked user by displaying a malicious form. Version 0.202.10 contains a patch for the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | nocodb | 0.202.10 | GHSA-qg73-g3cf-vhhh |
Affected products (as reported)
Weakness: CWE-434, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
References
- https://github.com/nocodb/nocodb/security/advisories/GHSA-qg73-g3cf-vhhh x_refsource_CONFIRM