CVE-2023-40869

Deeper analysis

CVE-2023-40869 is a cross-site scripting vulnerability, tracked under CWE-79, that affects mooSocial Software versions 3.1.6 and 3.1.7. The flaw resides in the edit_menu, copuon, and group_categorias functions and permits injection of malicious scripts through crafted input, as reflected in its CVSS 3.1 score of 6.1 with a network attack vector, low complexity, and required user interaction.

A remote attacker can exploit the issue without authentication by supplying a malicious payload that executes in the context of another user's session. Successful exploitation allows the attacker to achieve limited impacts on confidentiality and integrity, such as stealing session data or performing actions on behalf of the victim within the affected mooSocial instance.

Public references consist of GitHub repositories that document the vulnerability but contain no vendor advisories, patch details, or mitigation guidance. The associated EPSS score has remained flat at 0.0929 with no material increase since disclosure.