CVE-2023-33255 - Vulnerability Details - OpenCVE

An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web application without any kind of sanitization. This allows injection of arbitrary JavaScript code into image metadata, which is executed when that metadata is displayed in the Papaya web application.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Uthscsa	Papaya Viewer

Configuration 1 [-]

cpe:2.3:a:uthscsa:papaya_viewer:1.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/172644/Papaya-Medical-Viewer-1.0-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2023/May/21
https://schutzwerk.com
https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001.txt
https://www.schutzwerk.com/blog/schutzwerk-sa-2022-001/

History

Wed, 15 Jan 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-05-26T00:00:00

Updated: 2025-01-15T20:33:07.303Z

Reserved: 2023-05-21T00:00:00

Link: CVE-2023-33255

Vulnrichment

Updated: 2024-08-02T15:39:36.255Z

NVD

Status : Modified

Published: 2023-05-26T20:15:49.577

Modified: 2025-01-15T21:15:11.620

Link: CVE-2023-33255

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-33255", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-01-15T20:33:07.303Z", "dateReserved": "2023-05-21T00:00:00", "datePublished": "2023-05-26T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-06-09T00:00:00"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web application without any kind of sanitization. This allows injection of arbitrary JavaScript code into image metadata, which is executed when that metadata is displayed in the Papaya web application."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://schutzwerk.com"}, {"url": "https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001.txt"}, {"name": "20230530 SCHUTZWERK-SA-2022-001: Cross-Site-Scripting in Papaya Medical Viewer", "tags": ["mailing-list"], "url": "http://seclists.org/fulldisclosure/2023/May/21"}, {"url": "http://packetstormsecurity.com/files/172644/Papaya-Medical-Viewer-1.0-Cross-Site-Scripting.html"}, {"url": "https://www.schutzwerk.com/blog/schutzwerk-sa-2022-001/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:39:36.255Z"}, "title": "CVE Program Container", "references": [{"url": "https://schutzwerk.com", "tags": ["x_transferred"]}, {"url": "https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001.txt", "tags": ["x_transferred"]}, {"name": "20230530 SCHUTZWERK-SA-2022-001: Cross-Site-Scripting in Papaya Medical Viewer", "tags": ["mailing-list", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2023/May/21"}, {"url": "http://packetstormsecurity.com/files/172644/Papaya-Medical-Viewer-1.0-Cross-Site-Scripting.html", "tags": ["x_transferred"]}, {"url": "https://www.schutzwerk.com/blog/schutzwerk-sa-2022-001/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-15T20:33:02.017067Z", "id": "CVE-2023-33255", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-15T20:33:07.303Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://schutzwerk.com", "tags": ["x_transferred"]}, {"url": "https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001.txt", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/May/21", "name": "20230530 SCHUTZWERK-SA-2022-001: Cross-Site-Scripting in Papaya Medical Viewer", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/172644/Papaya-Medical-Viewer-1.0-Cross-Site-Scripting.html", "tags": ["x_transferred"]}, {"url": "https://www.schutzwerk.com/blog/schutzwerk-sa-2022-001/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:39:36.255Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-33255", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-15T20:33:02.017067Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-15T20:32:38.433Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://schutzwerk.com"}, {"url": "https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001.txt"}, {"url": "http://seclists.org/fulldisclosure/2023/May/21", "name": "20230530 SCHUTZWERK-SA-2022-001: Cross-Site-Scripting in Papaya Medical Viewer", "tags": ["mailing-list"]}, {"url": "http://packetstormsecurity.com/files/172644/Papaya-Medical-Viewer-1.0-Cross-Site-Scripting.html"}, {"url": "https://www.schutzwerk.com/blog/schutzwerk-sa-2022-001/"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web application without any kind of sanitization. This allows injection of arbitrary JavaScript code into image metadata, which is executed when that metadata is displayed in the Papaya web application."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-06-09T00:00:00"}}}, "cveMetadata": {"cveId": "CVE-2023-33255", "state": "PUBLISHED", "dateUpdated": "2025-01-15T20:33:07.303Z", "dateReserved": "2023-05-21T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-05-26T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:uthscsa:papaya_viewer:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "7A6105B5-FB4D-40A0-9F56-00A3E975169D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web application without any kind of sanitization. This allows injection of arbitrary JavaScript code into image metadata, which is executed when that metadata is displayed in the Papaya web application."}], "id": "CVE-2023-33255", "lastModified": "2025-01-15T21:15:11.620", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-05-26T20:15:49.577", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/172644/Papaya-Medical-Viewer-1.0-Cross-Site-Scripting.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/May/21"}, {"source": "cve@mitre.org", "tags": ["Not Applicable"], "url": "https://schutzwerk.com"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001.txt"}, {"source": "cve@mitre.org", "url": "https://www.schutzwerk.com/blog/schutzwerk-sa-2022-001/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/172644/Papaya-Medical-Viewer-1.0-Cross-Site-Scripting.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/May/21"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://schutzwerk.com"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.schutzwerk.com/blog/schutzwerk-sa-2022-001/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}