CVE-2023-40024

    Dashboard / Vulnerabilities / CVE-2023-40024

    CVE-2023-40024

    Published: 14 Aug 2023Last Modified: 27 Aug 2026

    Summary: Reflected Cross-Site Scripting (XSS) in scancode.io license endpoint

    Details: ScanCode.io is a server to script and automate software composition analysis pipelines. In the `/license/` endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist. Attackers can exploit this vulnerability to inject malicious scripts into the response generated by the `license_details_view` function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information. This issue has been addressed in release `32.5.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    References: https://github.com/nexB/scancode.io/blob/dd7769fbc97c84545579cebf1dc4838214098a11/CHANGELOG.rst#v3252-2023-08-14, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40024.json, https://github.com/nexB/scancode.io/security/advisories/GHSA-6xcx-gx7r-rccj, https://nvd.nist.gov/vuln/detail/CVE-2023-40024

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -9a698e87f25c775c1114e6132ef84cf2c35449f9

    Affected versions

    v32.5.1
    v32.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-40024 | CVE-DB