Platform
php
Component
phpipam/phpipam
Fixed in
1.5.1
CVE-2023-0676 describes a Reflected Cross-Site Scripting (XSS) vulnerability discovered in phpipam, an IP address management system. This vulnerability allows an attacker to inject malicious scripts into a user's browser via crafted URLs. Versions of phpipam prior to 1.5.1 are affected. A patch has been released to address this issue.
The primary impact of CVE-2023-0676 is the potential for an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to several malicious outcomes, including session hijacking, where an attacker gains control of a legitimate user's account. Furthermore, attackers could steal sensitive information displayed on the page, such as API keys or authentication tokens. The vulnerability is 'reflected,' meaning the malicious script is directly embedded in a URL, making it relatively easy to exploit through phishing or social engineering tactics. While the CVSS score is low, the potential for account compromise and data theft warrants immediate attention.
CVE-2023-0676 was publicly disclosed on February 4, 2023. There are currently no reports of active exploitation in the wild. No Proof-of-Concept (PoC) code has been publicly released, but the nature of a reflected XSS vulnerability makes exploitation relatively straightforward. The vulnerability is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.97% (77% percentile)
CVSS Vector
The recommended mitigation for CVE-2023-0676 is to immediately upgrade phpipam to version 1.5.1 or later. If upgrading is not immediately feasible, consider implementing input validation and output encoding on all user-supplied data within the phpipam application. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update your phpipam installation to ensure you are protected against known vulnerabilities.
Update phpipam to version 1.5.1 or higher. This version contains the fix for the reflected XSS vulnerability. You can download the latest version from the official phpipam GitHub repository.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2023-0676 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting phpipam versions prior to 1.5.1. It allows attackers to inject malicious scripts into a user's browser via crafted URLs.
You are affected if you are running phpipam version 1.5.1 or earlier. Check your installation version and upgrade immediately if necessary.
The fix is to upgrade to phpipam version 1.5.1 or later. If upgrading is not possible, implement input validation and output encoding as temporary mitigations.
As of now, there are no confirmed reports of active exploitation of CVE-2023-0676 in the wild.
Refer to the phpipam GitHub repository for the advisory and release notes: https://github.com/phpipam/phpipam/releases/tag/1.5.1
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.