CVE-2023-44012

Deeper analysis

CVE-2023-44012 is a cross-site scripting vulnerability, tracked as CWE-79, that affects mojoPortal version 2.7.0.0. The flaw resides in the Help.aspx component and is triggered through the helpkey parameter, enabling a remote attacker to supply malicious input that results in arbitrary code execution. It carries a CVSS 3.1 base score of 6.1 reflecting network attack vector, low complexity, no required privileges, and required user interaction with changed scope.

An unauthenticated remote attacker can exploit the issue by crafting a request containing a malicious helpkey value that is reflected back to a victim user. Successful exploitation allows the attacker to execute arbitrary script in the context of the victim's browser session, potentially leading to theft of session tokens or other client-side actions within the affected mojoPortal instance.

The two referenced GitHub disclosure entries contain no details on official patches, workarounds, or vendor mitigation guidance. The associated EPSS score has remained flat at 0.1520 with no material increase since disclosure.