CVE-2023-3849
Published: 23 July 2023
Summary
CVE-2023-3849 is a low-severity Cross-site Scripting (CWE-79) vulnerability in Moosocial Moodating. Its CVSS base score is 3.5 (Low).
Operationally, ranked in the top 9.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A cross-site scripting vulnerability exists in mooSocial mooDating version 1.2 within the URL handler component, specifically the /find-a-match endpoint. The issue, tracked as CVE-2023-3849 and assigned CWE-79, arises from improper handling of input that allows script injection; it received a CVSS 3.1 score of 3.5 reflecting network attack vector, low complexity, required low-privileged authentication, and user interaction.
An authenticated attacker can supply a crafted URL to the affected endpoint and trigger execution of arbitrary script in a victim user's browser session, resulting in limited integrity impact such as content manipulation without affecting confidentiality or availability. The attack can be performed remotely once the malicious link is delivered.
Public references on Vuldb and Packetstorm document the flaw and include a proof-of-concept, but no vendor patch or official advisory is available; attempts to contact the maintainer via the listed email address were unsuccessful. The EPSS score rose from a low baseline to a recorded peak of 0.0981, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-44477
Vulnerability details
A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the…
more
attack remotely. The identifier of this vulnerability is VDB-235200. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.