{"id":"CVE-2023-6890","published":"2023-12-16T08:57:31Z","modified":"2024-08-02T08:42:08Z","title":"Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq","vendor":"thorsten","product":"thorsten/phpmyfaq","tier":"tail","description":{"text":"Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00464,"percentile":0.40215,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://huntr.com/bounties/2cf11678-8793-4fa1-b21a-f135564a105d","tags":[]},{"url":"https://github.com/thorsten/phpmyfaq/commit/97d90ebbe11ebc6081bf49a2ba4b60f227cd1b43","tags":[]}],"priority":{"score":11.8,"factors":[{"name":"EPSS percentile","points":8.04},{"name":"CVSS severity","points":3.78}]},"vendorSlug":"thorsten","affectedVersions":[{"vendor":"thorsten","product":"thorsten/phpmyfaq","versions":[">= unspecified, < 3.1.17"]}],"affected":[{"ecosystem":"Packagist","package":"thorsten/phpmyfaq","vulnerableRanges":["<3.1.17"],"patched":["3.1.17"],"from":["GHSA-4h37-q5j3-hw96"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-3099","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-thorsten-phpmyfaq-cve-2022-3608","parents":[{"from":"CVE-2023-2752","to":"CVE-2023-6890","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["phpmyfaq/src/phpMyFAQ/Helper/FaqHelper.php"],"commits":["https://github.com/thorsten/phpmyfaq/commit/e7599d49b0ece7ceef3a4e8d334782cc3df98be8","https://github.com/thorsten/phpmyfaq/commit/97d90ebbe11ebc6081bf49a2ba4b60f227cd1b43"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.91,"basis":"same product + CWE + description similarity"}]},{"from":"CVE-2023-2753","to":"CVE-2023-6890","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["phpmyfaq/src/phpMyFAQ/Helper/FaqHelper.php"],"commits":["https://github.com/thorsten/phpmyfaq/commit/5401ab75d022932b8d5d7adaa771acf44fed18ba","https://github.com/thorsten/phpmyfaq/commit/97d90ebbe11ebc6081bf49a2ba4b60f227cd1b43"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.91,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-4006","published":"2023-07-31","fixed":"3.1.16","kev":false},{"cve":"CVE-2023-4007","published":"2023-07-31","fixed":"3.1.16","kev":false,"link":{"from":"CVE-2023-4007","to":"CVE-2023-6890","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:thorsten/phpmyfaq","fromFixed":"3.1.16","toFixed":"3.1.17","daysApart":138},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2023-6889","published":"2023-12-16","fixed":"3.1.17","kev":false},{"cve":"CVE-2023-6890","published":"2023-12-16","fixed":"3.1.17","kev":false},{"cve":"CVE-2023-5227","published":"2023-09-30","fixed":"3.1.18","kev":false},{"cve":"CVE-2023-5316","published":"2023-09-30","fixed":"3.1.18","kev":false},{"cve":"CVE-2023-5317","published":"2023-09-30","fixed":"3.1.18","kev":false}],"package":"Packagist:thorsten/phpmyfaq"}}