CVE-2023-41889

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

SHIRASAGI is a Content Management System. Prior to version 1.18.0, SHIRASAGI is vulnerable to a Post-Unicode normalization issue. This happens when a logical validation or a security check is performed before a Unicode normalization. The Unicode character equivalent of a character would resurface after the normalization. The fix is initially performing the Unicode normalization and then strip for all whitespaces and then checking for a blank string. This issue has been fixed in version 1.18.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-176 CWE-116

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-41894.8Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-418907.5Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versi CVE-2023-418918.8FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124,CVE-2023-418929.8Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installat CVE-2023-418935.4Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable CVE-2023-418945.3Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable v CVE-2023-418959.6Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials a CVE-2023-418969.0Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_cal CVE-2023-418979.6Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Option CVE-2023-418987.8Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbit CVE-2023-418997.2Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Reque CVE-2023-41906.5Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.