{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-49277", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-11-24T16:45:24.311Z", "datePublished": "2023-12-01T20:48:06.371Z", "dateUpdated": "2023-12-01T20:48:06.371Z"}, "containers": {"cna": {"title": "Reflected Cross-site Scripting Vulnerability in dpaste", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39"}, {"name": "https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086", "tags": ["x_refsource_MISC"], "url": "https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086"}], "affected": [{"vendor": "DarrenOfficial", "product": "dpaste", "versions": [{"version": "< 3.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-01T20:48:06.371Z"}, "descriptions": [{"lang": "en", "value": "dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. Users are strongly advised to upgrade to dpaste release v3.8 or later versions, as dpaste versions older than v3.8 are susceptible to the identified security vulnerability. No known workarounds have been identified, and applying the patch is the most effective way to remediate the vulnerability."}], "source": {"advisory": "GHSA-r8j9-5cj7-cv39", "discovery": "UNKNOWN"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:darrennathanael:dpaste:*:*:*:*:*:*:*:*", "matchCriteriaId": "52C6FF15-547C-4FAF-B1EC-4E0C090D9A69", "versionEndExcluding": "3.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. Users are strongly advised to upgrade to dpaste release v3.8 or later versions, as dpaste versions older than v3.8 are susceptible to the identified security vulnerability. No known workarounds have been identified, and applying the patch is the most effective way to remediate the vulnerability."}, {"lang": "es", "value": "dpaste es una aplicaci\u00f3n de Pastebin de c\u00f3digo abierto escrita en Python utilizando el framework Django. Se ha identificado una vulnerabilidad de seguridad en el par\u00e1metro de caducidad de la API dpaste, lo que permite un ataque POST Reflected XSS. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo JavaScript arbitrario en el contexto del navegador de un usuario, lo que podr\u00eda provocar acceso no autorizado, robo de datos u otras actividades maliciosas. Se recomienda encarecidamente a los usuarios que actualicen a la versi\u00f3n v3.8 de dpaste o versiones posteriores, ya que las versiones de dpaste anteriores a la v3.8 son susceptibles a vulnerabilidad de seguridad identificada. No se han identificado workarounds conocidos y aplicar el parche es la forma m\u00e1s eficaz de remediar la vulnerabilidad."}], "id": "CVE-2023-49277", "lastModified": "2023-12-06T20:55:31.683", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-12-01T21:15:08.857", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}