{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-49117"
      ],
      "details": "PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user\u0027s web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.",
      "id": "GSD-2023-49117",
      "modified": "2023-12-22T06:01:20.157807Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2023-49117",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "PowerCMS (PowerCMS 6 Series)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "6.31 and earlier"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "PowerCMS (PowerCMS 5 Series)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "5.24 and earlier"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "PowerCMS (PowerCMS 4 Series)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "4.54 and earlier"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Alfasado Inc."
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user\u0027s web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Cross-site scripting (XSS)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.powercms.jp/news/release-powercms-202312.html",
            "refsource": "MISC",
            "url": "https://www.powercms.jp/news/release-powercms-202312.html"
          },
          {
            "name": "https://jvn.jp/en/jp/JVN32646742/",
            "refsource": "MISC",
            "url": "https://jvn.jp/en/jp/JVN32646742/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "418BFF70-45BC-4F69-85DB-7C935B80CCEE",
                    "versionEndExcluding": "4.55",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4394A42A-9BE5-4927-93D7-74D99542D7D1",
                    "versionEndExcluding": "5.25",
                    "versionStartIncluding": "5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AEA525B4-37C1-4D8B-9755-740FD4665D0A",
                    "versionEndIncluding": "6.31",
                    "versionStartIncluding": "6.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user\u0027s web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
          },
          {
            "lang": "es",
            "value": "PowerCMS (Serie 6, Serie 5 y Serie 4) contiene una vulnerabilidad de cross-site scripting almacenado. Si se explota esta vulnerabilidad, se puede ejecutar un script arbitrario en el navegador web de un usuario que haya iniciado sesi\u00f3n. Tenga en cuenta que todas las versiones de PowerCMS Serie 3 y anteriores que no son compatibles (End-of-Life, EOL) tambi\u00e9n se ven afectadas por esta vulnerabilidad."
          }
        ],
        "id": "CVE-2023-49117",
        "lastModified": "2024-01-04T02:42:06.503",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2023-12-26T06:15:07.260",
        "references": [
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/en/jp/JVN32646742/"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.powercms.jp/news/release-powercms-202312.html"
          }
        ],
        "sourceIdentifier": "vultures@jpcert.or.jp",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}