« Volver al listado

CVE-2023-50473

Estado: ModificadaMedia (5.4)—

Vulnerabilidad de Cross-Site Scripting (XSS) en bill-ahmed qbit-matUI versión 1.16.4 permite a atacantes remotos obtener información confidencial a través de identificadores de sesión fijos (SID) en el archivo index.js.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Billahmed — Qbit Matui

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-50473",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-12-21T11:15:08.300",
  "references": [
    {
      "url": "https://github.com/bill-ahmed/qbit-matUI/issues/207",
      "tags": [
        "Issue Tracking"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/tianjk99/Cryptographic-Misuses/blob/main/CVE-2023-50473.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/bill-ahmed/qbit-matUI/issues/207",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/tianjk99/Cryptographic-Misuses/blob/main/CVE-2023-50473.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Scripting (XSS) vulnerability in bill-ahmed qbit-matUI version 1.16.4, allows remote attackers to obtain sensitive information via fixed session identifiers (SID) in index.js file."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Cross-Site Scripting (XSS) en bill-ahmed qbit-matUI versión 1.16.4 permite a atacantes remotos obtener información confidencial a través de identificadores de sesión fijos (SID) en el archivo index.js."
    }
  ],
  "lastModified": "2026-06-17T06:39:43.290",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:billahmed:qbit_matui:1.16.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C49AEFE-02A9-43F6-8D34-A7A6A974223A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}