Upstream information
Description
A vulnerability has been identified in which unauthenticated cross-sitescripting (XSS) in the API Server's public API endpoint can be
exploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser
SUSE information
Overall state of this security issue: Pending
This issue is currently rated as having important severity.
| CNA (SUSE) | SUSE | |
|---|---|---|
| Base Score | 8.3 | 8.3 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L |
| Attack Vector | Network | Network |
| Attack Complexity | Low | Low |
| Privileges Required | None | None |
| User Interaction | Required | Required |
| Scope | Unchanged | Unchanged |
| Confidentiality Impact | High | High |
| Integrity Impact | High | High |
| Availability Impact | Low | Low |
| CVSSv3 Version | 3.1 | 3.1 |
SUSE Security Advisories:
- GHSA-833m-37f7-jq55, published Thu Feb 8 18:56:59 CET 2024
SUSE Timeline for this CVE
CVE page created: Fri Jan 19 14:45:13 2024CVE page last modified: Mon Nov 18 14:12:18 2024