CVE-2023-7076: XSS in MyAAC 0.8.0 - 0.8.13

Successful exploitation of CVE-2023-7076 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to a variety of malicious outcomes, including stealing user credentials, redirecting users to phishing sites, or modifying the content of the web page. The impact is amplified if the application handles sensitive data or is integrated with other systems. An attacker could potentially gain access to user accounts and perform actions on their behalf, leading to data breaches and reputational damage. While the CVSS score is LOW, the ease of exploitation and potential impact on user data warrant immediate attention.

1. Reserved2023-12-22
2. Published2023-12-22
3. Modified2024-11-21
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-7076 is to upgrade MyAAC to version 0.8.14 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the bugtracker.php page to sanitize user-supplied data. Web application firewalls (WAFs) can be configured to detect and block malicious XSS payloads targeting the vulnerable parameters. Review and harden the application's security configuration to minimize the attack surface. After upgrading, confirm the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the bug report form and verifying that it is properly neutralized.