CVE-2023-5556

Deeper analysis

CVE-2023-5556 is a reflected cross-site scripting vulnerability (CWE-79) affecting the Structurizr on-premises application in GitHub repository structurizr/onpremises prior to build 3194. The flaw carries a CVSS 3.1 base score of 6.1 with network attack vector, low complexity, no required privileges, and required user interaction, resulting in limited impacts to confidentiality and integrity under a changed scope.

An unauthenticated remote attacker can exploit the issue by crafting a malicious URL that, when visited by a victim user, causes the application to reflect attacker-controlled script content back into the browser. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim’s session, potentially leading to theft of session tokens or other client-side actions within the Structurizr application.

Public references point to a fix merged in commit 6cff4f792b010dfb1ff6a0b4ae1c6e398f8f8a18, which addresses the reflected XSS vector; practitioners should upgrade to on-premises build 3194 or later to remediate the exposure. The associated EPSS score has remained near 0.27 with negligible movement between current and peak values.