Vulnerability · Published Feb 2, 2024 · Assigned by INCIBE
CVE-2024-23895Cross-Site Scripting (XSS) vulnerability in Cups Easy
High 8.2
In plain English
A high-severity cross-site scripting in Cups Easy (Purchase & Inventory) from Cups Easy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/locationcreate.php, in the locationid parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cups Easy | Cups Easy (Purchase & Inventory) | 1.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N