Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-0934

CVE-2023-0934: Answer vulnerable to Cross-site Scripting

5.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-0934
GHSA ID
GHSA-6cvf-m58q-h9wf
EPSS Score
0.19057%
CWE
CWE-79
Published
2/21/2023
Updated
3/6/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/answerdev/answergo< 1.0.51.0.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing input sanitization in the site configuration update flow. The patch added a new Sanitizer validation directive using bluemonday's UGCPolicy to critical fields in SiteGeneralReq. Prior to 1.0.5, the UpdateGeneral controller endpoint accepted and stored these fields (Name, ShortDescription, etc.) without proper HTML escaping, as evidenced by the addition of 'sanitizer' validation tags in the schema and the new Sanitizer function in the validator. The combination of unsanitized storage in siteinfo_controller.go and missing validation rules in siteinfo_schema.go created the XSS vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ross-sit* S*riptin* (XSS) - Stor** in *it*u* r*pository *nsw*r**v/*nsw*r prior to *.*.*.

Reasoning

T** vuln*r**ility st*ms *rom missin* input s*nitiz*tion in t** sit* *on*i*ur*tion up**t* *low. T** p*t** ***** * n*w S*nitiz*r v*li**tion *ir**tiv* usin* *lu*mon**y's U**Poli*y to *riti**l *i*l*s in Sit***n*r*lR*q. Prior to *.*.*, t** Up**t***n*r*l *