CVE-2023-2862 is a cross-site scripting (XSS) vulnerability affecting SiteServer CMS versions up to 7.2.1. Specifically, manipulating the 'ajaxDivId' argument within the /api/stl/actions/search file can lead to the injection of malicious scripts. This vulnerability has a CVSS score of 6.1 (Medium), indicating it can be exploited remotely with low attack complexity, requiring user interaction. A successful attack could result in limited confidentiality and integrity impacts. While the exploit has been publicly disclosed, there is no evidence of active exploitation (KEV listed as No), nor are there readily available exploits in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 7.2.1CPE matchmatch criteria | cpe:2.3:a:sscms:siteserver_cms:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.