CVE-2023-27008
Published: 28 March 2023
Summary
CVE-2023-27008 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Atutor Atutor. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 2.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-27008 is a reflected cross-site scripting vulnerability (CWE-79) affecting ATutor version 2.2.1. The flaw resides in the encrypt_password function inside login.tmpl.php and can be triggered by supplying a crafted token parameter that is insufficiently sanitized before being rendered in the response.
An unauthenticated remote attacker can exploit the issue by luring a victim into following a malicious link or submitting a manipulated request containing the token payload. Successful exploitation allows injection of arbitrary JavaScript or HTML, enabling actions such as session hijacking, credential theft, or defacement within the context of the affected ATutor instance; the vulnerability carries a CVSS 3.1 score of 6.1.
Public references consist of a technical disclosure detailing the token-parameter vector but contain no information on official patches or vendor advisories. The associated EPSS score has reached a peak of 0.4307 with a current value of 0.3972, indicating sustained moderate exploitation interest following publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-30798
Vulnerability details
A Cross-site scripting (XSS) vulnerability in the function encrypt_password() in login.tmpl.php in ATutor 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.