CVE-2023-48199
HIGH EPSS 39.1%
Published Nov 15, 20232y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
Published Nov 15, 2023 2y ago
Last Modified Jun 17, 2026 2w ago
Description
HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker can then manipulate page content in the QR code detail popup, often coupled with social engineering tactics, exploiting both the trust of users and the application's lack of proper input handling.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
39.1% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-74
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| grocy_project | grocy | 4.0.3 | any |
References 4
- github.com https://github.com/grocy/grocy
- grocy.info https://grocy.info
- nitipoom-jar.github.io https://nitipoom-jar.github.io/CVE-2023-48199/
- nitipoom-jaroonchaipipat.github.io https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48199
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.