CVE-2023-29015: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

April 7, 2023

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user’s browser when displaying the comment. The vulnerability has been fixed in version 23.03.

References

github.com/advisories/GHSA-622w-995c-3c3h
github.com/intranda/goobi-viewer-core/commit/f0ccde2d469efd9597c3062d00177a63341f2256
github.com/intranda/goobi-viewer-core/security/advisories/GHSA-622w-995c-3c3h
nvd.nist.gov/vuln/detail/CVE-2023-29015

Code Behaviors & Features

Detect and mitigate CVE-2023-29015 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →