CVE-2023-7238

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Orthanc	Osimis DICOM Web Viewer	1.4.2.0-9d9eff4

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01Third Party Advisory, US Government Resource

Timeline

Published: Jan 23, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-72397.5The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update CVE-2023-72405.8An improper authorization level has been detected in the login panel. It may lead to unauthenticated Server Side Request Forgery and allows CVE-2023-72417.9Privilege Escalation in WRSA.EXE in Webroot Antivirus 8.0.1X- 9.0.35.12 on Windows64 bit and 32 bit allows malicious software to abuse WRS CVE-2023-72428.2Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bou CVE-2023-72439.8Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bou CVE-2023-72449.8Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bou CVE-2023-72457.8The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to CVE-2023-72465.4The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multis CVE-2023-72474.9The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.CVE-2023-72489.8Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests. The vulnerability would affect CVE-2023-72499.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows CVE-2023-72505.3A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send