CVE-2023-49277Medium· 6.1▾ SunlitReflected XSS Vulnerability in dpaste
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.5%
Last analysed / modified upstream
A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
At this time, the recommended course of action is to apply the provided patch to the affected systems. No known workarounds have been identified, and applying the patch is the most effective way to remediate the vulnerability.
dpaste < 3.8Upgrade to a patched release:
dpaste 3.8