CVE-2023-24278
Published: 18 March 2023
Summary
CVE-2023-24278 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Squidex.Io Squidex. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Squidex versions prior to 7.4.0 contain a reflected cross-site scripting vulnerability in the squid.svg endpoint, tracked as CVE-2023-24278 under CWE-79. The flaw carries a CVSS 3.1 score of 6.1, reflecting network attack vector, low complexity, no required privileges, required user interaction, and changed scope with limited confidentiality and integrity impact.
An unauthenticated remote attacker can supply a crafted request to the affected endpoint; when a victim user follows the resulting link or loads the resource, script execution occurs in the user's browser context, enabling actions such as session token theft or interface manipulation within the Squidex application.
Public advisories published by Census Labs and OpenWall on 16 March 2023 describe the reflected XSS behavior in the squidsvg endpoint and align with the vendor's release of version 7.4.0 that addresses the issue. The associated EPSS score has remained flat at 0.6489 with no material post-disclosure increase observed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28335
Vulnerability details
Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.