{"id":"CVE-2023-3469","published":"2023-06-30T00:00:19Z","modified":"2024-11-12T15:05:06Z","title":"Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq","vendor":"thorsten","product":"thorsten/phpmyfaq","tier":"tail","description":{"text":"Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.2,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00576,"percentile":0.47483,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://huntr.dev/bounties/3565cfc9-82c4-4db8-9b8f-494dd81b56ca","tags":[]},{"url":"https://github.com/thorsten/phpmyfaq/commit/04a0183c25dd425f4c2bfb5f75b7650b932ae278","tags":[]}],"priority":{"score":13.1,"factors":[{"name":"EPSS percentile","points":9.5},{"name":"CVSS severity","points":3.64}]},"vendorSlug":"thorsten","affectedVersions":[{"vendor":"thorsten","product":"thorsten/phpmyfaq","versions":[">= unspecified, < 3.2.0-beta.2"]}],"affected":[{"ecosystem":"Packagist","package":"thorsten/phpmyfaq","vulnerableRanges":["<3.2.0-beta.2"],"patched":["3.2.0-beta.2"],"from":["GHSA-v6g2-jwrm-h5r5"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-44130","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-thorsten-phpmyfaq-cve-2022-3608","parents":[{"from":"CVE-2022-3608","to":"CVE-2023-3469","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["phpmyfaq/admin/backup.import.php"],"commits":["https://github.com/thorsten/phpmyfaq/commit/37123edd50f854bd141e6fbe65221af2d5cf2677","https://github.com/thorsten/phpmyfaq/commit/04a0183c25dd425f4c2bfb5f75b7650b932ae278"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.75,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2022-3608","published":"2022-10-19","fixed":"3.2.0-alpha","kev":false},{"cve":"CVE-2023-2752","published":"2023-05-17","fixed":"3.2.0-beta","kev":false,"link":{"from":"CVE-2023-2752","to":"CVE-2023-3469","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:thorsten/phpmyfaq","fromFixed":"3.2.0-beta","toFixed":"3.2.0-beta.2","daysApart":44},{"kind":"similar","provenance":"machine","score":0.93,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2023-2753","published":"2023-05-17","fixed":"3.2.0-beta","kev":false},{"cve":"CVE-2023-3469","published":"2023-06-30","fixed":"3.2.0-beta.2","kev":false},{"cve":"CVE-2023-5864","published":"2023-10-31","fixed":"3.2.1","kev":false,"link":{"from":"CVE-2023-3469","to":"CVE-2023-5864","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:thorsten/phpmyfaq","fromFixed":"3.2.0-beta.2","toFixed":"3.2.1","daysApart":123},{"kind":"similar","provenance":"machine","score":0.84,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2023-5866","published":"2023-10-31","fixed":"3.2.1","kev":false,"link":{"from":"CVE-2023-3469","to":"CVE-2023-5866","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:thorsten/phpmyfaq","fromFixed":"3.2.0-beta.2","toFixed":"3.2.1","daysApart":123}]}},{"cve":"CVE-2023-5863","published":"2023-10-31","fixed":"3.2.2","kev":false}],"package":"Packagist:thorsten/phpmyfaq"}}