CVE-2023-48644 - Vulnerability Details - OpenCVE

An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feature of the maintenance module, via the description field. This allows an attacker to perform an action on behalf of the user, exfiltrate data, and so on.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Eptura	Archibus Archibus Ios Application

Configuration 1 [-]

cpe:2.3:a:eptura:archibus:4.0.3:*:*:*:iphone_os:*:*:*

No data.

References

Link	Providers
https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48644
https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644

History

Fri, 30 May 2025 16:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Eptura archibus Ios Application
CPEs		cpe:2.3:a:eptura:archibus_ios_application:4.0.3:::::::*
Vendors & Products		Eptura archibus Ios Application
References		https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48644
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 23 May 2025 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Eptura Eptura archibus
CPEs		cpe:2.3:a:eptura:archibus:4.0.3::::iphone_os:::
Vendors & Products		Eptura Eptura archibus

Mon, 19 Aug 2024 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-03-05T00:00:00.000Z

Updated: 2025-06-03T02:12:43.170Z

Reserved: 2023-11-17T00:00:00.000Z

Link: CVE-2023-48644

Vulnrichment

Updated: 2024-08-02T21:37:53.568Z

NVD

Status : Modified

Published: 2024-03-05T23:15:07.260

Modified: 2025-05-30T16:15:35.230

Link: CVE-2023-48644

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-48644", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-06-03T02:12:43.170Z", "dateReserved": "2023-11-17T00:00:00.000Z", "datePublished": "2024-03-05T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-05-30T16:02:56.622Z"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feature of the maintenance module, via the description field. This allows an attacker to perform an action on behalf of the user, exfiltrate data, and so on."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644"}, {"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48644"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:37:53.568Z"}, "title": "CVE Program Container", "references": [{"url": "https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "affected": [{"vendor": "eptura", "product": "archibus_ios_application", "cpes": ["cpe:2.3:a:eptura:archibus_ios_application:4.0.3:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "4.0.3", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-19T17:39:47.179697Z", "id": "CVE-2023-48644", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-03T02:12:43.170Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:37:53.568Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-48644", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-19T17:39:47.179697Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:eptura:archibus_ios_application:4.0.3:*:*:*:*:*:*:*"], "vendor": "eptura", "product": "archibus_ios_application", "versions": [{"status": "affected", "version": "4.0.3"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-19T17:46:09.917Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://excellium-services.com/cert-xlm-advisory/CVE-2023-48644"}, {"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48644"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feature of the maintenance module, via the description field. This allows an attacker to perform an action on behalf of the user, exfiltrate data, and so on."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-05-30T16:02:56.622Z"}}}, "cveMetadata": {"cveId": "CVE-2023-48644", "state": "PUBLISHED", "dateUpdated": "2025-06-03T02:12:43.170Z", "dateReserved": "2023-11-17T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-03-05T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}