Published:2023/10/04  Last Updated:2023/10/04

JVN#08237727
Citadel WebCit vulnerable to cross-site scripting on Instant Messaging facility

Overview

Citadel WebCit contains a cross-site scripting vulnerability.

Products Affected

  • Citadel versions prior to 994

Description

Citadel WebCit provided by Citadel contains a cross-site scripting vulnerability (CWE-79).

Impact

When a malicious user sends an instant message with some JavaScript code, the script may be executed on the web browser of the victim user.

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.

This issue is fixed on version 994.

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score: 5.4
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N
Base Score: 3.5
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)

Credit

Tomoro Taniguchi of FiveDrive, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2023-44272
JVN iPedia JVNDB-2023-000097

Update History

2023/10/04
Fixed typo under the section [Impact]