CVEvulnerability
CVE-2023-48197
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-11-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the "see QR code" function.
Affected configurations
• grocy project grocy 4.0.3
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/grocy/grocy Product
- https://nitipoom-jar.github.io/CVE-2023-48197/ Exploit, Third Party Advisory
- https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48197 nitipoom-jaroonchaipipat.github.io
- https://github.com/grocy/grocy Product
- https://nitipoom-jar.github.io/CVE-2023-48197/ Exploit, Third Party Advisory