CVE-2023-38878 in OpenSTAManager
Summary
by MITRE • 09/12/2023
A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious payload into the 'error' and 'error_description' parameters of 'oauth2.php'.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/20/2026
This reflected cross-site scripting vulnerability exists within DevCode OpenSTAManager versions 2.4.24 through 2.4.47, representing a critical security flaw that enables remote attackers to inject malicious JavaScript code into victim browsers. The vulnerability specifically affects the oauth2.php endpoint where the 'error' and 'error_description' parameters are not properly sanitized or validated before being rendered in the web application's response. When a malicious user crafts a specially crafted URL containing XSS payloads within these parameters and tricks a victim into clicking the link, the malicious code executes in the victim's browser context, potentially leading to session hijacking, credential theft, or further exploitation of the victim's browser session. This vulnerability falls under CWE-79 which specifically addresses Cross-Site Scripting flaws in web applications where input data is not properly escaped or validated before being included in dynamically generated web pages.
The operational impact of this vulnerability extends beyond simple script execution as it creates a persistent attack vector that can be exploited across multiple user sessions and environments. Attackers can leverage this flaw to bypass authentication mechanisms, steal sensitive information, manipulate user sessions, or redirect victims to malicious websites. The reflected nature of this XSS means that the malicious payload is not stored on the server but rather injected into the application's response, making it particularly dangerous as it requires no persistent storage on the target system. The vulnerability is classified as a remote code execution risk under the ATT&CK framework's technique T1566, specifically targeting the initial access phase where adversaries use web-based attacks to gain entry into target systems.
Mitigation strategies for this vulnerability should prioritize immediate patching of affected OpenSTAManager versions to the latest stable releases that contain proper input validation and output encoding for the oauth2.php endpoint. Organizations should implement comprehensive input sanitization measures that properly escape or filter all user-supplied data before rendering it in web responses, particularly for parameters that are directly reflected in the application's output. The implementation of Content Security Policy headers should be enforced to limit the execution of unauthorized scripts, while also deploying web application firewalls that can detect and block suspicious patterns in incoming requests. Additionally, security teams should conduct regular penetration testing and input validation reviews to identify similar vulnerabilities in other application components, with particular attention to endpoints that handle authentication flows and error reporting mechanisms where user input is processed and displayed.