Vulnerability · Published Sep 25, 2023 · Assigned by Fluid Attacks
CVE-2023-4892Teedy v1.11 - Stored cross-site scripting (XSS)
Medium 5.7
In plain English
A medium-severity cross-site scripting in Teedy from Teedy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)0.4%top 61.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Teedy v1.11 has a vulnerability in its text editor that allows events to be executed in HTML tags that an attacker could manipulate. Thanks to this, it is possible to execute malicious JavaScript in the webapp.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N