CVE-2023-5950

    Dashboard / Vulnerabilities / CVE-2023-5950

    CVE-2023-5950

    Published: 6 Nov 2023Last Modified: 28 Oct 2026

    Summary: Rapid7 Velociraptor Reflected XSS

    Details: Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed in version 0.7.0-04 and a patch is available to download. Patches are also available for version 0.6.9 (0.6.9-1).

    References: https://github.com/Velocidex/velociraptor/releases/tag/v0.7.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5950.json, https://nvd.nist.gov/vuln/detail/CVE-2023-5950

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -be0af2d943fda22f65e04f9d63848d67c853f6f9

    Affected versions

    0.7.0-3
    0.7.0-NA
    0.7.0-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-5950 | CVE-DB