Vulnerability record/PUBLISHED/Published Oct 4, 2023 14:26:01 UTC
CVE-2023-3971
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
Base score7.3/ 10
SeverityHighCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionRequiredUI
ScopeUnchangedS
Confidentiality impactHighC
Integrity impactHighI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 7, 2026 11:32:44 UTC
PublishedOct 4, 2023 14:26:01 UTC
ReservedJul 27, 2023 07:24:40 UTC
Credits
- Red Hat would like to thank Kunal Pusdekar (redhat) for reporting this issue.