Cross-site scripting in Vite - CVE-2023-49293
Published: January 27, 2025
Vulnerability identifier: #VU103307
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2023-49293
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability occurs when vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`<script type="module">...</script>`). A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Affected software
Vite
Guardium Data Security Center (GDSC)
IBM Concert Software
Guardium Data Security Center (GDSC)
IBM Concert Software
How to mitigate CVE-2023-49293
Install updates from vendor's website.
Vite - addressed in versions 4.4.12, 4.5.1, 5.0.5
IBM Concert Software - update to 2.0.0
Guardium Data Security Center (GDSC) - update to 3.6.1
IBM Concert Software - update to 2.0.0
Guardium Data Security Center (GDSC) - update to 3.6.1