Skip to content
Heist/ feed
Back to feed
Low

SiteServer CMS search cross site scripting

Type: advisorySources: OSV

A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Affected is an unknown function of the file /api/stl/actions/search. The manipulation of the argument ajaxDivId leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-229818 is the identifier assigned to this vulnerability.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2023-2862
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 11:10 UTC · Revision 1

Source evidence

SiteServer CMS search cross site scripting

core-osv · Original source

Published 24 May 2023, 09:31 UTC

A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Affected is an unknown function of the file /api/stl/actions/search. The manipulation of the argument ajaxDivId leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-229818 is the identifier assigned to this vulnerability.

osv:CVE-2023-2862
Complete source record
{
  "id": "812f59b9d906ea9e633f9fa6668139b8611ef9820076157566ad6898ef8db86d",
  "url": "https://osv.dev/vulnerability/CVE-2023-2862",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SiteServer CMS search cross site scripting",
    "summary": "A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Affected is an unknown function of the file /api/stl/actions/search. The manipulation of the argument ajaxDivId leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-229818 is the identifier assigned to this vulnerability.",
    "evidence": "osv:CVE-2023-2862",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2023-2862",
      "aliases": [
        "CVE-2023-2862",
        "GHSA-63c6-w556-3h7q"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/siteserver/cms",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "6dfda976f4d1108c7f6db46b54920cec89851cb1"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:sscms:siteserver_cms:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "7.2.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "sscms-v7.2.1",
            "sscms-v7.2.0",
            "sscms-v7.1.3",
            "siteserver-v6.10.1",
            "siteserver-v6.10.0-beta",
            "siteserver-v6.9.15-beta",
            "siteserver-v6.9.14-beta",
            "siteserver-v6.9.13-beta",
            "siteserver-v6.9.12-beta",
            "siteserver-v6.9.10-beta",
            "siteserver-v6.9.9-beta",
            "siteserver-v6.9.4-beta",
            "siteserver-v6.9.3-beta",
            "siteserver-v6.9.2-beta",
            "siteserver-v6.9.1-beta",
            "siteserver-v6.9.0",
            "siteserver-v6.8.3",
            "siteserver-v6.8.1",
            "siteserver-v6.8.0",
            "siteserver-v6.7.17-beta",
            "siteserver-v6.7.15-beta",
            "siteserver-v6.7.14-beta",
            "siteserver-v6.7.13-beta",
            "siteserver-v6.7.12-beta",
            "siteserver-v6.7.11-beta",
            "siteserver-v6.7.10-beta",
            "siteserver-v6.7.9-beta",
            "siteserver-v6.7.8-beta",
            "siteserver-v6.7.6",
            "siteserver-v6.7.5-beta",
            "siteserver-v6.7.4",
            "siteserver-v6.7.3-beta",
            "siteserver-v6.7.2-beta",
            "siteserver-v6.7.1",
            "siteserver-v6.7.0",
            "siteserver-v6.6.41-beta",
            "siteserver-v6.6.40-beta",
            "siteserver-v6.6.39-beta",
            "siteserver-v6.6.38-beta",
            "siteserver-v6.6.37-beta",
            "siteserver-v6.6.36-beta",
            "siteserver-v6.6.35-beta",
            "siteserver-v6.6.34-beta",
            "siteserver-v6.6.33-beta",
            "siteserver-v6.6.32-beta",
            "siteserver-v6.6.31-beta",
            "siteserver-v6.6.30-beta",
            "siteserver-v6.6.27-beta",
            "siteserver-v6.6.26-beta",
            "siteserver-v6.6.25-beta",
            "siteserver-v6.6.24-beta",
            "siteserver-v6.6.23-beta",
            "siteserver-v6.6.22-beta",
            "siteserver-v6.6.21-beta",
            "siteserver-v6.6.20-beta",
            "siteserver-v6.6.19-beta",
            "siteserver-v6.6.18-beta",
            "siteserver-v6.6.17-beta",
            "siteserver-v6.6.15-beta",
            "siteserver-v6.6.14-beta",
            "siteserver-v6.6.13-beta",
            "upload",
            "siteserver-v6.6.12-beta",
            "siteserver-v6.6.11-beta",
            "siteserver-v6.6.10-beta",
            "siteserver-v6.6.9-beta",
            "siteserver-v6.6.8-beta",
            "siteserver-v6.6.7-beta",
            "siteserver-v6.6.6-beta",
            "siteserver-v6.6.5-beta",
            "siteserver-v6.6.4-beta",
            "siteserver-v6.6.3-beta",
            "siteserver-v6.6.2",
            "siteserver-v6.6.1-beta",
            "siteserver-v6.6.0-beta",
            "siteserver-v6.5.24-beta",
            "siteserver-v6.5.23-beta",
            "siteserver-v6.5.22-beta",
            "siteserver-v6.5.21-beta",
            "siteserver-v6.5.19-beta",
            "siteserver-v6.5.18-beta",
            "siteserver-v6.5.17-beta",
            "siteserver-v6.5.16-beta",
            "siteserver-v6.5.14-beta",
            "siteserver-v6.5.13-beta",
            "siteserver-v6.5.6-beta",
            "siteserver-v6.5.5-beta",
            "siteserver-v6.5.4-beta",
            "siteserver-v6.5.3-beta",
            "siteserver-v6.5.2-beta",
            "siteserver-v6.5.1",
            "siteserver-v6.5.0-beta",
            "siteserver-v6.4.15-beta",
            "siteserver-v6.4.14-beta",
            "siteserver-v6.4.13-beta",
            "siteserver-v6.4.12-beta",
            "siteserver-v6.4.11-beta",
            "siteserver-v6.4.10-beta",
            "siteserver-v6.4.9-beta",
            "siteserver-v6.4.8-beta",
            "siteserver-v6.4.7-beta",
            "siteserver-v6.4.6-beta",
            "siteserver-v6.4.5-beta",
            "siteserver-v6.4.4-beta",
            "siteserver-v6.4.3-beta",
            "siteserver-v6.4.1",
            "siteserver-v6.4.0-beta",
            "siteserver-v6.3.36-beta",
            "siteserver-v6.3.35-beta",
            "siteserver-v6.3.34-beta",
            "siteserver-v6.3.33-beta",
            "siteserver-v6.3.32-beta",
            "siteserver-v6.3.31-beta",
            "siteserver-v6.3.26-beta",
            "siteserver-v6.3.25-beta",
            "siteserver-v6.3.24-beta",
            "siteserver-v6.3.20-beta",
            "siteserver-v6.3.19-beta",
            "siteserver-v6.3.18-beta",
            "siteserver-v6.3.17-beta",
            "siteserver-v6.3.16-beta",
            "siteserver-v6.3.14-beta",
            "siteserver-v6.3.12",
            "siteserver-v6.3.11-beta",
            "siteserver-v6.3.10-beta",
            "siteserver-v6.3.9-beta",
            "siteserver-v6.3.2",
            "siteserver-v6.3.1-beta",
            "siteserver-v6.3.0-beta",
            "siteserver-v6.2.20-beta",
            "siteserver-v6.2.19-beta",
            "siteserver-v6.2.18-beta",
            "siteserver-v6.2.17-beta",
            "siteserver-v6.2.15-beta",
            "siteserver-v6.2.14-beta",
            "siteserver-v6.2.13-beta",
            "siteserver-v6.2.12-beta",
            "siteserver-v6.2.11-beta",
            "siteserver-v6.2.10-beta",
            "siteserver-v6.2.9-beta",
            "siteserver-v6.2.8-beta",
            "siteserver-v6.2.7-beta",
            "siteserver-v6.2.6-beta",
            "siteserver-v6.2.0",
            "siteserver-v6.1.27-beta",
            "siteserver-v6.1.26-beta",
            "siteserver-v6.1.25-beta",
            "siteserver-v6.1.24-beta",
            "siteserver-v6.1.23-beta",
            "siteserver-v6.1.22-beta",
            "siteserver-v6.1.21-beta",
            "siteserver-v6.1.20-beta",
            "siteserver-v6.1.19-beta",
            "siteserver-v6.1.18-beta",
            "siteserver-v6.1.17-beta",
            "siteserver-v6.1.16-beta",
            "siteserver-v6.1.15-beta",
            "siteserver-v6.1.14-beta",
            "siteserver-v6.1.11-preview",
            "siteserver-v6.1.10-preview",
            "siteserver-v6.1.9-preview",
            "siteserver-v6.1.8-preview",
            "siteserver-v6.1.7-preview",
            "siteserver-v6.1.5-preview",
            "siteserver-v6.1.4-preview",
            "siteserver-v6.1.3",
            "siteserver-v6.1.2-preview",
            "siteserver-v6.1.1",
            "siteserver-v6.1.0-preview",
            "siteserver-v6.0.259-preview",
            "siteserver-v6.0.258-preview",
            "siteserver-v6.0.257-preview",
            "siteserver-v6.0.256-preview",
            "siteserver-v6.0.255-preview",
            "siteserver-v6.0.254-preview",
            "siteserver-v6.0.253-preview",
            "siteserver-v6.0.252-preview",
            "siteserver-v6.0.251-preview",
            "siteserver-v6.0.250-preview",
            "siteserver-v6.0.249-preview",
            "siteserver-v6.0.248-preview",
            "siteserver-v6.0.247-preview",
            "siteserver-v6.0.246",
            "siteserver-v6.0.245-preview",
            "siteserver-v6.0.244-preview",
            "siteserver-v6.0.243",
            "siteserver-v6.0.242-preview",
            "siteserver-v6.0.241-preview",
            "siteserver-v6.0.240-preview",
            "siteserver-v6.0.233",
            "siteserver-v6.0.232-preview",
            "siteserver-v6.0.220-rc2",
            "siteserver-v6.0.219-preview",
            "siteserver-v6.0.231",
            "siteserver-v6.0.230-preview",
            "siteserver-v6.0.229-preview",
            "siteserver-v6.0.228-preview",
            "siteserver-v6.0.227-preview",
            "siteserver-v6.0.226-preview",
            "siteserver-v6.0.225-preview",
            "siteserver-v6.0.224-preview",
            "siteserver-v6.0.222-preview",
            "siteserver-v6.0.218-rc2",
            "siteserver-v6.0.216-preview",
            "siteserver-v6.0.215-preview",
            "siteserver-v6.0.214-preview",
            "siteserver-v6.0.212-preview",
            "siteserver-v6.0.211-preview",
            "siteserver-v6.0.210-rc1",
            "siteserver-v6.0.{build}-rc1",
            "siteserver-v6.0.0-rc1",
            "siteserver-v5.0.145",
            "siteserver-v5.0.143",
            "siteserver-v5.0.136",
            "siteserver-v5.0.135",
            "siteserver-v5.0.128",
            "siteserver-v5.0.127",
            "siteserver-v5.0.126",
            "siteserver-v5.0.82",
            "siteserver-v5.0.81",
            "siteserver-v5.0.78",
            "siteserver-dev-v5.0.55",
            "siteserver-dev-v5.0.53",
            "siteserver-dev-v5.0.40",
            "siteserver-dev-v5.0.37",
            "siteserver-dev-v5.0.25",
            "siteserver-dev-v5.0.24",
            "siteserver-dev-v5.0.23",
            "siteserver-dev-v5.0.22",
            "siteserver-dev-v5.0.18",
            "siteserver-v5.0.15"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-2862.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:50.564027122Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2862.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-2862",
        "https://vuldb.com/?id.229818",
        "https://vuldb.com/?ctiid.229818",
        "https://gitee.com/siteserver/cms/issues/I71WJ4"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-79"
        ],
        "cna_assigner": "VulDB",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "7.2.0"
                  },
                  {
                    "last_affected": "7.2.0"
                  },
                  {
                    "introduced": "7.2.1"
                  },
                  {
                    "last_affected": "7.2.1"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandaloneSingleVersion"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2862.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-2862",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 519088,
  "published_at": "2023-05-24T09:31:03.789+00:00"
}