Quick answers
- Is CVE-2023-46495 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-46495 being exploited in the wild.
- How severe is CVE-2023-46495?
- Low severity, with a CVSS score of 3.1, published 8 December 2023.
- Which products and versions are affected?
- EverShop < 1.0.0-rc.8; @evershop/evershop (npm) SEMVER:introduced=0,fixed=1.0.0-rc.8.
- Is there a fix for CVE-2023-46495?
- Yes. @evershop/evershop (npm): upgrade to 1.0.0-rc.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-46495 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2023-46495?
- Check whether you run EverShop or @evershop/evershop (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @evershop/evershop (npm): upgrade to 1.0.0-rc.8 or later
npm install @evershop/evershop@1.0.0-rc.8
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in EverShop versions prior to 1.0.0-rc.8. The vulnerability is located in the handling of the 'sortBy' parameter. By providing a second 'sortBy' parameter in a crafted HTTP request, an attacker can bypass existing input validation, causing the application to reflect the unsanitized second value back into the page's HTML. This can be exploited by a remote, unauthenticated attacker to execute arbitrary JavaScript in the context of a user's browser session, provided the user interacts with a malicious link. The issue is addressed in version 1.0.0-rc.8.
Affected products
- EverShop evershop < 1.0.0-rc.8
Identifiers
- CVE-2023-46495
- GHSA-2xcj-557c-hf8r
Timeline
- 2023-09-26: patched: Fix merged in pull request 338
- 2023-12-08: disclosed: NVD publication date
- 2023-12-08: advisory: GitHub Advisory published