Bug Finder ChainCity Real Estate Investment Platform 1.0 New Ticket create subject cross site scripting

EntryDiffjsonxmlCTI

A vulnerability classified as problematic has been found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected is an unknown function of the file /chaincity/user/ticket/create of the component New Ticket Handler. The manipulation of the argument subject leads to cross site scripting. Using CWE to declare the problem leads to CWE-79. The weakness was disclosed 07/20/2023. This vulnerability is traded as CVE-2023-3794. It is possible to launch the attack remotely. Technical details are available. Furthermore, there is an exploit available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project. It is declared as proof-of-concept. As 0-day the estimated underground price was around $0-$5k. The vendor was contacted early about this disclosure but did not respond in any way. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	48

Field

vulnerability_cvss3_meta_tempscore	2
vulnerability_cvss3_meta_basescore	2
vulnerability_cvss3_cna_basescore	1
vulnerability_cvss3_nvd_basescore	1
vulnerability_cvss2_nvd_basescore	1

Commit Conf

90%	35
70%	26
50%	10

Approve Conf

90%	35
70%	25
80%	10

ID	Commited	User	Field	Change	Remarks	Accepted	Status	C
14597130	08/15/2023	VulD...	cvss3_cna_basescore	3.5	see CVSS documentation	08/15/2023	accepted	90
14597129	08/15/2023	VulD...	cvss3_nvd_basescore	6.1	nist.gov	08/15/2023	accepted	90
14597128	08/15/2023	VulD...	cvss2_nvd_basescore	4.0	nist.gov	08/15/2023	accepted	90
14597127	08/15/2023	VulD...	cvss3_meta_tempscore	4.3	see CVSS documentation	08/15/2023	accepted	90
14597126	08/15/2023	VulD...	cvss3_meta_basescore	4.4	see CVSS documentation	08/15/2023	accepted	90
14597125	08/15/2023	VulD...	cve_cna	VulDB	nvd.nist.gov	08/15/2023	accepted	70
14597124	08/15/2023	VulD...	cvss3_cna_a	N	nvd.nist.gov	08/15/2023	accepted	70
14597123	08/15/2023	VulD...	cvss3_cna_i	L	nvd.nist.gov	08/15/2023	accepted	70
14597122	08/15/2023	VulD...	cvss3_cna_c	N	nvd.nist.gov	08/15/2023	accepted	70
14597121	08/15/2023	VulD...	cvss3_cna_s	U	nvd.nist.gov	08/15/2023	accepted	70
14597120	08/15/2023	VulD...	cvss3_cna_ui	R	nvd.nist.gov	08/15/2023	accepted	70
14597119	08/15/2023	VulD...	cvss3_cna_pr	L	nvd.nist.gov	08/15/2023	accepted	70
14597118	08/15/2023	VulD...	cvss3_cna_ac	L	nvd.nist.gov	08/15/2023	accepted	70
14597117	08/15/2023	VulD...	cvss3_cna_av	N	nvd.nist.gov	08/15/2023	accepted	70
14597116	08/15/2023	VulD...	cvss2_nvd_ai	N	nvd.nist.gov	08/15/2023	accepted	70
14597115	08/15/2023	VulD...	cvss2_nvd_ii	P	nvd.nist.gov	08/15/2023	accepted	70
14597114	08/15/2023	VulD...	cvss2_nvd_ci	N	nvd.nist.gov	08/15/2023	accepted	70
14597113	08/15/2023	VulD...	cvss2_nvd_au	S	nvd.nist.gov	08/15/2023	accepted	70
14597112	08/15/2023	VulD...	cvss2_nvd_ac	L	nvd.nist.gov	08/15/2023	accepted	70
14597111	08/15/2023	VulD...	cvss2_nvd_av	N	nvd.nist.gov	08/15/2023	accepted	70

51 more entries are not shown

🔒 Login Required

You need to signup and login to see more of the remaining 51 results.

◂ Previous Overview Next ▸

Interested in the pricing of exploits?

See the underground prices here!