CVE-2023-29015

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. The vulnerability has been fixed in version 23.03.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-290166.1The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability CVE-2023-290179.8vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handlinCVE-2023-290188.8The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows forCVE-2023-290198.1@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affectedCVE-2023-29026.5A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unkCVE-2023-290206.5@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enCVE-2023-290225.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290236.1A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious CVE-2023-290246.5A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product A cross site scripting vulnerability waCVE-2023-290255.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290265.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290275.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciou