CVE-2023-43326
Published: 25 September 2023
Summary
CVE-2023-43326 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Moosocial Moosocial. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 2.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A reflected cross-site scripting vulnerability exists in multiple URLs of mooSocial version 3.1.8. The flaw, tracked as CVE-2023-43326 and assigned CWE-79, permits injection of arbitrary scripts that execute in the context of a victim user's browser. It carries a CVSS 3.1 score of 6.1, reflecting network attack vector, low complexity, no required privileges, and required user interaction with changed scope.
An unauthenticated attacker can craft a malicious URL and deliver it to a mooSocial user; when the recipient follows the link, the injected script runs and can exfiltrate session cookies, enabling account impersonation. The attack requires the victim to click the link but needs no other authentication or special access.
Public references consist of a proof-of-concept repository and the vendor site; neither advisory text nor patch details are provided in the available sources. The EPSS score remains flat at its recorded peak of 0.3474 with no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-47745
Vulnerability details
A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.