CVE-2023-6568

MEDIUM Year: 2023
CVSS v3 Score
6.5
Medium
Weakness Type
CWE-79
View all →

Vulnerability Description

A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading to arbitrary JavaScript execution in the context of the victim's browser. The vulnerability is present in the mlflow/server/auth/__init__.py file, where the user-supplied Content-Type header is directly injected into a Python formatted string and returned to the user, facilitating the XSS attack.

Related Vulnerabilities

CVE-2014-9701

MEDIUM
CVSS:6.5(Medium)

Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalink_page....

CWE-792014

CVE-2015-7916

MEDIUM
CVSS:6.5(Medium)

Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.

CWE-792015

CVE-2016-11085

MEDIUM
CVSS:6.5(Medium)

php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishand...

CWE-792016

CVE-2017-17062

MEDIUM
CVSS:6.5(Medium)

The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows remote authenticated users to save arbitr...

CWE-792017

CVE-2018-10854

MEDIUM
CVSS:6.5(Medium)

cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scriptin...

CWE-792018

CVE-2018-1253

MEDIUM
CVSS:6.5(Medium)

RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit ...

CWE-792018