Cyber Resilience

CVE-2023-24278

MediumPublic PoC

Published: 18 March 2023

Published
18 March 2023
Modified
26 February 2025
KEV Added
Patch
CVSS Score v3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score 0.6489 98.5th percentile
Risk Priority 51 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-24278 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Squidex.Io Squidex. Its CVSS base score is 6.1 (Medium).

Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Squidex versions prior to 7.4.0 contain a reflected cross-site scripting vulnerability in the squid.svg endpoint, tracked as CVE-2023-24278 under CWE-79. The flaw carries a CVSS 3.1 score of 6.1, reflecting network attack vector, low complexity, no required privileges, required user interaction, and changed scope with limited confidentiality and integrity impact.

An unauthenticated remote attacker can supply a crafted request to the affected endpoint; when a victim user follows the resulting link or loads the resource, script execution occurs in the user's browser context, enabling actions such as session token theft or interface manipulation within the Squidex application.

Public advisories published by Census Labs and OpenWall on 16 March 2023 describe the reflected XSS behavior in the squidsvg endpoint and align with the vendor's release of version 7.4.0 that addresses the issue. The associated EPSS score has remained flat at 0.6489 with no material post-disclosure increase observed.

EU & UK References

Vulnerability details

Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

squidex.io
squidex
≤ 7.4.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-79

Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

addresses: CWE-79

Validates web inputs to reject script-related content that could produce XSS.

addresses: CWE-79

Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.

References