CVE-2023-49117

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-49117", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2023-12-21T12:24:04.679Z", "datePublished": "2023-12-26T05:53:40.513Z", "dateUpdated": "2024-08-02T21:46:29.150Z"}, "containers": {"cna": {"affected": [{"vendor": "Alfasado Inc.", "product": "PowerCMS (PowerCMS 6 Series)", "versions": [{"version": "6.31 and earlier", "status": "affected"}]}, {"vendor": "Alfasado Inc.", "product": "PowerCMS (PowerCMS 5 Series)", "versions": [{"version": "5.24 and earlier", "status": "affected"}]}, {"vendor": "Alfasado Inc.", "product": "PowerCMS (PowerCMS 4 Series)", "versions": [{"version": "4.54 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."}], "problemTypes": [{"descriptions": [{"description": "Cross-site scripting (XSS)", "lang": "en", "type": "text"}]}], "references": [{"url": "https://www.powercms.jp/news/release-powercms-202312.html"}, {"url": "https://jvn.jp/en/jp/JVN32646742/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-12-26T05:53:40.513Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:46:29.150Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.powercms.jp/news/release-powercms-202312.html", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN32646742/", "tags": ["x_transferred"]}]}]}}

{}

{"affected": [{"affectedData": [{"product": "PowerCMS (PowerCMS 6 Series)", "vendor": "Alfasado Inc.", "versions": [{"status": "affected", "version": "6.31 and earlier"}]}, {"product": "PowerCMS (PowerCMS 5 Series)", "vendor": "Alfasado Inc.", "versions": [{"status": "affected", "version": "5.24 and earlier"}]}, {"product": "PowerCMS (PowerCMS 4 Series)", "vendor": "Alfasado Inc.", "versions": [{"status": "affected", "version": "4.54 and earlier"}]}], "source": "vultures@jpcert.or.jp"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*", "matchCriteriaId": "418BFF70-45BC-4F69-85DB-7C935B80CCEE", "versionEndExcluding": "4.55", "vulnerable": true}, {"criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*", "matchCriteriaId": "4394A42A-9BE5-4927-93D7-74D99542D7D1", "versionEndExcluding": "5.25", "versionStartIncluding": "5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*", "matchCriteriaId": "AEA525B4-37C1-4D8B-9755-740FD4665D0A", "versionEndIncluding": "6.31", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."}, {"lang": "es", "value": "PowerCMS (Serie 6, Serie 5 y Serie 4) contiene una vulnerabilidad de cross-site scripting almacenado. Si se explota esta vulnerabilidad, se puede ejecutar un script arbitrario en el navegador web de un usuario que haya iniciado sesi\u00f3n. Tenga en cuenta que todas las versiones de PowerCMS Serie 3 y anteriores que no son compatibles (End-of-Life, EOL) tambi\u00e9n se ven afectadas por esta vulnerabilidad."}], "id": "CVE-2023-49117", "lastModified": "2026-06-17T06:35:24.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-26T06:15:07.260", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN32646742/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.powercms.jp/news/release-powercms-202312.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN32646742/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.powercms.jp/news/release-powercms-202312.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}