« Volver al listado

CVE-2023-47175

Estado: ModificadaMedia (6.1)—

Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the product.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Luxsoft — Luxcal WEB Calendar

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-47175",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-47175",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-29T13:41:50.710965Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "LuxSoft",
          "product": "LuxCal Web Calendar",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.2.4M (MySQL version)"
            }
          ]
        },
        {
          "vendor": "LuxSoft",
          "product": "LuxCal Web Calendar",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.2.4L (SQLite version)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-11-20T05:15:08.953",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN15005948/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.luxsoft.eu/",
      "tags": [
        "Product"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.luxsoft.eu/?download",
      "tags": [
        "Release Notes"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.luxsoft.eu/lcforum/viewtopic.php?id=476",
      "tags": [
        "Issue Tracking"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN15005948/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.luxsoft.eu/",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.luxsoft.eu/?download",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.luxsoft.eu/lcforum/viewtopic.php?id=476",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the product."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Cross-site scripting en LuxCal Web Calendar anterior a 5.2.4M (versión MySQL) y LuxCal Web Calendar anterior a 5.2.4L (versión SQLite) permite a un atacante remoto no autenticado ejecutar un script arbitrario en el navegador web del usuario que está acceder al producto."
    }
  ],
  "lastModified": "2026-06-17T06:32:17.277",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:luxsoft:luxcal_web_calendar:*:*:*:*:sqlite:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A266C1B-1918-4316-8651-86EE836418ED",
              "versionEndExcluding": "5.2.4l"
            },
            {
              "criteria": "cpe:2.3:a:luxsoft:luxcal_web_calendar:*:*:*:*:mysql:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "666FC249-C711-437A-B205-9C9A1FE49E01",
              "versionEndExcluding": "5.2.4m"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}