CVE-2023-3847

Deeper analysis

A cross-site scripting vulnerability exists in mooSocial mooDating version 1.2 within the URL handler component handling the /users path. The issue, tracked as CVE-2023-3847 and assigned CWE-79, arises from improper input sanitization that permits script injection through manipulated parameters. It received a CVSS 3.1 score of 3.5, reflecting network attack vector, low complexity, and required user interaction.

An authenticated attacker with low privileges can supply a crafted URL that, when visited by another user, executes arbitrary JavaScript in the victim's browser context. The attack is fully remote and results in limited integrity impact without affecting confidentiality or availability. No special conditions beyond a logged-in session and victim interaction are required.

Public references on VulDB and Packet Storm document the flaw and include proof-of-concept material, but the vendor could not be reached via its published contact address and no official patch or mitigation guidance has been issued. The associated EPSS score reached a modest peak of 0.1132 before receding to its current value of 0.0992, indicating limited but observable post-disclosure interest.