medium6.1
CVE-2023-29014
Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter
Impact
### Impact A reflected cross-site scripting vulnerability has been identified in Goobi viewer core when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. ### Patches The vulnerability has been fixed in version 23.03 ### Credits We would like to thank [RUS-CERT](https://cert.uni-stuttgart.de/) for reporting this issues. If you have any questions or comments about this advisory: * Email us at [support@intranda.com](mailto:support@intranda.com)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.goobi.viewer:viewer-core | < 23.03 | 23.03 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Intranda | Goobi Viewer Core | before 23.03 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/intranda/goobi-viewer-core/commit/c29efe60e745a94d03debc17681c4950f3917455
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-7v7g-9vx6-vcg2
- https://github.com/advisories/GHSA-7v7g-9vx6-vcg2
- https://nvd.nist.gov/vuln/detail/CVE-2023-29014