CVE-2023-7238 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer

CVE-2023-7238

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer PUBLISHED

Description (CNA)

A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.

Affected (CNA)

Vendor / product	Versions
Orthanc / Osimis DICOM Web Viewer	affected 1.4.2.0-9d9eff4

CWE

CWE-79

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01

ADP enrichment

CVE

No English description supplied.

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01

CISA-ADP

No English description supplied.

No references supplied.