CVE-2023-30394

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The MoveIt framework 1.1.11 for ROS allows cross-site scripting (XSS) via the API authentication function. NOTE: this issue is disputed by the original reporter because it has "no impact."

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
moveit	moveit	1.1.11

References

https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-30394Third Party Advisory
https://github.com/ros-planning/moveitProduct
https://i.ibb.co/R2JSPV5/2022-10-02-12-39-57-Window.pngBroken Link
https://i.ibb.co/RyRSzpN/Response-Manipulation.pngBroken Link
https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-30394Third Party Advisory
https://github.com/ros-planning/moveitProduct
https://i.ibb.co/R2JSPV5/2022-10-02-12-39-57-Window.pngBroken Link
https://i.ibb.co/RyRSzpN/Response-Manipulation.pngBroken Link

Timeline

Published: May 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-303998.1Insecure permissions in the settings page of GARO Wallbox GLB/GTB/GTC before v189 allows attackers to redirect users to a crafted update pac CVE-2023-30407.5A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out CVE-2023-304009.8An issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18. A command injection vulnerability in the network configuration script CVE-2023-304025.5YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re. Note: This has been disputed CVE-2023-304037.5An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to bypass CVE-2023-304049.8Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd param CVE-2023-304055.4A cross-site scripting (XSS) vulnerability in Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to execute arbitrary web sc CVE-2023-304065.5Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpe CVE-2023-304085.5Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry.CVE-2023-30416.1The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the CVE-2023-304105.5Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component ecma_op_function_construct at /operations/ecma-funct CVE-2023-304145.5Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component vm_loop at /jerry-core/vm/vm.c.