CVE-2023-24322 is a reflected cross-site scripting (XSS) vulnerability found in the FileDialog.aspx component of mojoPortal v2.7.0.0. This flaw allows attackers to inject arbitrary web scripts or HTML through specially crafted 'ed' and 'tbi' parameters. Rated as Medium severity (CVSS 6.1), this vulnerability is network-exploitable with low attack complexity, requiring user interaction to achieve partial impact on confidentiality and integrity. Its high FAUCET Risk Score of 95/100 and above-average EPSS score indicate a significant potential risk. While not listed in CISA's KEV catalog, there are public Nuclei templates available for detecting this XSS. The vulnerability has garnered some community discussion and media coverage, suggesting awareness, but there is no evidence of active exploitation or Metasploit/ExploitDB entries.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.7.0.0CPE matchmatch criteria | cpe:2.3:a:mojoportal:mojoportal:2.7.0.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.