CVE-2023-29983

Deeper analysis

CVE-2023-29983 is a stored cross-site scripting vulnerability in Maximilian Vogt cmaps version 8.0. The flaw resides in the auditlog tab of the administrative interface and stems from insufficient sanitization of user-supplied input, allowing script content to be persisted and later rendered in other users' browsers.

An authenticated attacker with low-privileged access can supply a malicious payload through the affected tab; when an administrator subsequently views the audit log, the script executes in that administrator's session context. Successful exploitation yields the ability to perform actions on behalf of the viewing administrator, such as reading sensitive data or modifying application state within the same origin, consistent with the reported CVSS vector requiring both authentication and user interaction.

Public proof-of-concept material and exploit listings have been posted to GitHub, Exploit-DB, and PacketStorm, indicating that working demonstrations are readily available. The associated EPSS score reached a peak of 0.4083 and currently stands at 0.3064, reflecting sustained but not sharply escalating exploitation interest after disclosure.