CVE-2023-46952

MediumCVSS 6.1

Published: 17/01/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

36th percentile - higher than 36% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability was found in ABO.CMS version 5.9.3. The flaw allows an attacker to execute arbitrary JavaScript code via a crafted Referer header.

Risk Assessment

An attacker can exploit this vulnerability to steal user sessions, redirect to malicious sites, or steal sensitive data. The risk is especially high if the CMS is used in a production environment with public access.

Recommendation

Immediately update ABO.CMS to the latest available version that includes a fix for this vulnerability. Additionally, implement server-side filtering and sanitization of the Referer header.

Original NVD description (English source)

Cross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer header.