CVE-2023-29014

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. The vulnerability has been fixed in version 23.03.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
intrandagoobi-viewer-core< 23.03

References

Timeline

Published
Apr 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-290156.1The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability CVE-2023-290166.1The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability CVE-2023-290179.8vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handlinCVE-2023-290188.8The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows forCVE-2023-290198.1@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affectedCVE-2023-29026.5A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unkCVE-2023-290206.5@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enCVE-2023-290225.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290236.1A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious CVE-2023-290246.5A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product A cross site scripting vulnerability waCVE-2023-290255.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290265.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciou
CVE-2023-29014: Medium severity, CVSS 6.1 | Vulnix