CVE-2023-24737
Published: 06 March 2023
Summary
CVE-2023-24737 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Sigb Pmb. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 12.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
PMB version 7.4.6 contains a reflected cross-site scripting vulnerability in the query parameter processed by the script at /admin/convert/export_z3950.php. The flaw is tracked as CVE-2023-24737 and is classified under CWE-79, with a CVSS 3.1 score of 6.1 reflecting network attack vector, low complexity, no required privileges, and required user interaction that produces changed scope with limited confidentiality and integrity impact.
An unauthenticated attacker can supply a crafted URL containing malicious JavaScript in the query parameter; when a user such as an administrator follows the link, the script executes in the victim's browser context, allowing actions such as session token theft or unauthorized actions within the PMB administrative interface.
The two provided references point to public proof-of-concept material on GitHub but contain no official vendor advisory or patch guidance.
EPSS for the CVE rose from a low baseline to a peak of 0.1489 before receding to the current value of 0.0341, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28747
Vulnerability details
PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.