CVE-2023-34537
published 2023-06-13CVE-2023-34537: A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on…
PriorityP432medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EXPLOIT
EPSS
1.45%
70.1th percentile
A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | hoteldruid | < hoteldruid 3.0.6-1 (sid) | hoteldruid 3.0.6-1 (sid) |
| digitaldruid | hoteldruid | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
osv5.4MEDIUM
vendor_debian5.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2023-34537: hoteldruid - A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issu...
vendor_debian·2023·CVSS 5.4
CVE-2023-34537 [MEDIUM] CVE-2023-34537: hoteldruid - A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issu...
A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
Scope: local
bookworm: open
bullseye: open
sid: resolved (fixed in 3.0.6-1)
OSV
CVE-2023-34537: A Reflected XSS was discovered in HotelDruid version 3
osv·2023-06-13·CVSS 5.4
CVE-2023-34537 [MEDIUM] CVE-2023-34537: A Reflected XSS was discovered in HotelDruid version 3
A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
GHSA
GHSA-hvmq-jxc9-7gcc: A Reflected XSS was discovered in HotelDruid version 3
ghsa_unreviewed·2023-06-13
CVE-2023-34537 [MEDIUM] CWE-79 GHSA-hvmq-jxc9-7gcc: A Reflected XSS was discovered in HotelDruid version 3
A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
No detection rules found.
Nuclei
Hoteldruid 3.0.5 - Cross-Site Scripting
nuclei·CVSS 5.4
CVE-2023-34537 [MEDIUM] Hoteldruid 3.0.5 - Cross-Site Scripting
Hoteldruid 3.0.5 - Cross-Site Scripting
A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
Template:
id: CVE-2023-34537
info:
name: Hoteldruid 3.0.5 - Cross-Site Scripting
author: Harsh
severity: medium
description: |
A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
impact: |
Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
remediation: |
Upgrade to the latest version to mi
No writeups or analysis indexed.
2023-06-13
Published