CVE-2023-29016: Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames
Vulnerability summary
CVE-2023-29016 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in intranda goobi_viewer_core. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.5% of scored vulnerabilities.
Timeline
- 06-04-2023PublishedVulnerability first disclosed.
- 10-02-2025Last modifiedVulnerability information updated.
Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when using nicknames. An attacker could create a user account and enter malicious scripts into their profile's nickname, resulting in the execution in the user's browser when displaying the nickname on certain pages. The vulnerability has been fixed in version 23.03.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.44% on 23-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Intranda2 products
- goobi_viewer_core< 23.03
- goobi-viewer-core< 23.03
Io.goobi.viewer1 product
- viewer-core< 23.03
2 vendors · 3 products
References
4 links- github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2r9r-8fcg-m38gX Refsource CONFIRMWEBVendor Advisory
- github.com/intranda/goobi-viewer-core/commit/8eadb32b3fdcb775678b74d95bc3df018a5d5238X Refsource MISCWEBPatch
