CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2023-49453

Reflected cross-site scripting (XSS) vulnerability in Racktables v0.22.0 and before, allows local attackers to execute arbitrary code and obtain sensitive information via the search component in index.php.

Score
6.1 medium
Published
2024-03-12
Links
NVD · cve.org

Matched ports (5)

PortPackageVersionStatusMaintainer
sysutils/racktablesracktables-php820.22.0_1unaddresseddinoex@FreeBSD.org
sysutils/racktablesracktables-php830.22.0_1unaddresseddinoex@FreeBSD.org
sysutils/racktablesracktables-php840.22.0_1unaddresseddinoex@FreeBSD.org
sysutils/racktablesracktables-php850.22.0_1unaddresseddinoex@FreeBSD.org
sysutils/racktablesracktables-php860.22.0_1unaddresseddinoex@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>racktables-php82</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>racktables-php83</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>racktables-php84</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>racktables-php85</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>racktables-php86</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Reflected cross-site scripting (XSS) vulnerability in Racktables
	v0.22.0 and before, allows local attackers to execute arbitrary code
	and obtain sensitive information via the search component in
	index.php.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2023-49453</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2023-49453</url>
    </references>
    <dates>
      <discovery>2024-03-12</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>