CVE-2023-45757 is a cross-site scripting (XSS) vulnerability affecting Apache bRPC versions 1.6.0 and earlier on all platforms. An unauthenticated attacker can inject arbitrary XSS code into the built-in rpcz page by sending a specially crafted HTTP request to a bRPC server with rpcz enabled. This vulnerability has a CVSS score of 6.1 (Medium), indicating low confidentiality and integrity impacts, and requires user interaction. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE. Organizations are advised to upgrade to bRPC > 1.6.0, apply a provided patch, or disable the rpcz feature to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.6.1CPE matchmatch criteria | cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.