CVE-2023-3726 - Vulnerability Details - OpenCVE

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ocsinventory-ng	Ocsinventory-ocsreports

Configuration 1 [-]

cpe:2.3:a:ocsinventory-ng:ocsinventory-ocsreports:2.12.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://fluidattacks.com/advisories/creed/
https://ocsinventory-ng.org/

History

Fri, 16 May 2025 23:00:00 +0000

Type	Values Removed	Values Added
Description	OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.	OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.
Metrics	cvssV3_1 `{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}`	cvssV3_1 `{'score': 6.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N'}`

Thu, 17 Apr 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Fluid Attacks

Published: 2024-01-04T14:39:43.942Z

Updated: 2025-09-24T15:23:57.483Z

Reserved: 2023-07-17T22:17:31.210Z

Link: CVE-2023-3726

Vulnrichment

Updated: 2024-08-02T07:01:57.374Z

NVD

Status : Modified

Published: 2024-01-04T15:15:09.117

Modified: 2025-05-16T23:15:18.847

Link: CVE-2023-3726

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-3726", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "state": "PUBLISHED", "assignerShortName": "Fluid Attacks", "dateReserved": "2023-07-17T22:17:31.210Z", "datePublished": "2024-01-04T14:39:43.942Z", "dateUpdated": "2025-09-24T15:23:57.483Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OCSInventory", "vendor": "OCSInventory", "versions": [{"status": "affected", "version": "2.12.0"}]}], "datePublic": "2023-08-11T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.</p>"}], "value": "OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2025-09-24T15:23:57.483Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://fluidattacks.com/advisories/creed/"}, {"tags": ["product"], "url": "https://ocsinventory-ng.org/"}], "source": {"discovery": "UNKNOWN"}, "title": "OCSInventory-ocsreports 2.12.0 - Stored cross-site Scripting", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:01:57.374Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://fluidattacks.com/advisories/creed/"}, {"tags": ["product", "x_transferred"], "url": "https://ocsinventory-ng.org/"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-01-08T18:03:07.909445Z", "id": "CVE-2023-3726", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T14:48:27.499Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://fluidattacks.com/advisories/creed/", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://ocsinventory-ng.org/", "tags": ["product", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:01:57.374Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-3726", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-01-08T18:03:07.909445Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-17T18:21:34.296Z"}}], "cna": {"title": "OCSInventory-ocsreports 2.12.0 - Stored cross-site Scripting", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OCSInventory", "product": "OCSInventory", "versions": [{"status": "affected", "version": "2.12.0"}], "defaultStatus": "unaffected"}], "datePublic": "2023-08-11T17:00:00.000Z", "references": [{"url": "https://fluidattacks.com/advisories/creed/", "tags": ["third-party-advisory"]}, {"url": "https://ocsinventory-ng.org/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.", "supportingMedia": [{"type": "text/html", "value": "<p>OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2025-09-24T15:23:57.483Z"}}}, "cveMetadata": {"cveId": "CVE-2023-3726", "state": "PUBLISHED", "dateUpdated": "2025-09-24T15:23:57.483Z", "dateReserved": "2023-07-17T22:17:31.210Z", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "datePublished": "2024-01-04T14:39:43.942Z", "assignerShortName": "Fluid Attacks"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ocsinventory-ng:ocsinventory-ocsreports:2.12.0:*:*:*:*:*:*:*", "matchCriteriaId": "D586CDF1-3C6D-4E0D-965C-707304577526", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting."}, {"lang": "es", "value": "OCSInventory permite almacenar plantillas de correo electr\u00f3nico con caracteres especiales que conducen a cross-site Scripting almacenado."}], "id": "CVE-2023-3726", "lastModified": "2025-05-16T23:15:18.847", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 4.7, "source": "help@fluidattacks.com", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 4.7, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2024-01-04T15:15:09.117", "references": [{"source": "help@fluidattacks.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://fluidattacks.com/advisories/creed/"}, {"source": "help@fluidattacks.com", "tags": ["Product"], "url": "https://ocsinventory-ng.org/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://fluidattacks.com/advisories/creed/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://ocsinventory-ng.org/"}], "sourceIdentifier": "help@fluidattacks.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "help@fluidattacks.com", "type": "Secondary"}]}