Upstream information
Description
A vulnerability has been identified in which unauthenticated cross-sitescripting (XSS) in Norman's public API endpoint can be exploited. This
can lead to an attacker exploiting the vulnerability to trigger
JavaScript code and execute commands remotely.
SUSE information
Overall state of this security issue: Pending
This issue is currently rated as having important severity.
| CNA (SUSE) | SUSE | |
|---|---|---|
| Base Score | 8.3 | 8.3 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L |
| Attack Vector | Network | Network |
| Attack Complexity | Low | Low |
| Privileges Required | None | None |
| User Interaction | Required | Required |
| Scope | Unchanged | Unchanged |
| Confidentiality Impact | High | High |
| Integrity Impact | High | High |
| Availability Impact | Low | Low |
| CVSSv3 Version | 3.1 | 3.1 |
SUSE Security Advisories:
- GHSA-r8f4-hv23-6qp6, published Thu Feb 8 18:56:58 CET 2024
SUSE Timeline for this CVE
CVE page created: Fri Jan 19 14:45:11 2024CVE page last modified: Mon Nov 18 14:12:18 2024