CVE-2023-43325
Published: 26 September 2023
Summary
CVE-2023-43325 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Moosocial Moosocial. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 5.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A reflected cross-site scripting vulnerability tracked as CVE-2023-43325 affects mooSocial version 3.1.8. The flaw resides in the data[redirect_url] parameter and is classified under CWE-79 with a CVSS 3.1 score of 6.1. Successful exploitation permits injection of arbitrary scripts that execute in the context of a visiting user.
An unauthenticated attacker can deliver a crafted URL to a target user; when the link is clicked, the injected script runs and can exfiltrate session cookies, enabling account impersonation. The attack requires user interaction but needs no privileges on the application itself.
EPSS scores for the CVE rose from lower values after disclosure to a peak of 0.1972 before settling at the current 0.1619, indicating measurable post-publication exploitation interest. The supplied references consist of a public proof-of-concept repository and the vendor site but contain no details on patches or mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-47744
Vulnerability details
A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.