Published: 27/04/2023 Updated: 30/05/2023

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 0

An XSS issue exists in Serenity Serene (and StartSharp) prior to 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be sent to an administrator user.

Vulnerable Product	Search on Vulmon	Subscribe to Product
serenity serene
serenity startsharp

Serenity and StartSharp Software versions prior to 671 suffer from file upload to cross site scripting, user enumeration, and reusable password reset token vulnerabilities ...

CWE-79 https://github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2 http://seclists.org/fulldisclosure/2023/May/14 http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html https://nvd.nist.gov https://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2023-31285

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect