CVE-2023-31285

Published: Apr 27, 2023

Modified: Feb 13, 2025

PUBLISHED

Description

An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be sent to an administrator user.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2

20230529 SEC Consult SA-20230516-0 :: Multiple Vulnerabilities in Serenity and StartSharp Software

mailing-list

http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2023-31285

Description

Affected Products

References