CVE-2023-48197

medium

Description

Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the "see QR code" function.

References

https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48197

https://nitipoom-jar.github.io/CVE-2023-48197/

https://github.com/grocy/grocy

Details

Source: Mitre, NVD

Published: 2023-11-15

Updated: 2025-09-29

Risk Information

CVSS v2

Base Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 5.4

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N