CVE-2023-48866

Name
CVE-2023-48866
Description
A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy <= 4.0.3 allows attackers to obtain the victim's cookies.
NVD Severity
unknown
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cve@mitre.org https://github.com/grocy/grocy
cve@mitre.org https://nitipoom-jar.github.io/CVE-2023-48866/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:grocy_project:grocy:*:*:*:*:*:*:*:* grocy >= None <= 4.0.3

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
grocy 3.19-community 4.0.3-r2 Will Sinatra <wpsinatra@gmail.com> possibly vulnerable