CVE-2023-29014

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. The vulnerability has been fixed in version 23.03.

Score

CVSS 3.1 6.1 Medium

Status

Modified - security-advisories@github.com

Published

2023-04-06

Last modified

2025-02-10

Weaknesses

CWE-79

Affected products

• Goobi-viewer-core (Intranda)
• Goobi Viewer Core (Intranda)

References

• https://github.com/intranda/goobi-viewer-core/commit/c29efe60e745a94d03debc17681c4950f3917455
• https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-7v7g-9vx6-vcg2