TI-2023-04949 Aliases CVE-2023-5378 GHSA-9w3h-593p-q56r

Stored XSS in SmodBIP and MegaBIP

MEDIUM 41CWE-79Published 2024-01-29 · Updated 2025-06-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2. MegaBIP 5.08 was tested and is not vulnerable. A precise range of vulnerable versions remains unknown.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00527 44th percentileScored 2026-11-07

Fix Fixed MegaBIP (Jan Syski): 5.08

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jan Syski	MegaBIP	up to 4.36.2	5.08	Patch available	CNA
Jan Syski	SmodBIP	all versions	—	No fix listed	CNA

MegaBIP VendorJan Syski Affected up to 4.36.2 Fixed in 5.08 Patch available CNA
SmodBIP VendorJan Syski Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:megabip:megabip::::::::	up to 4.36.2	Vulnerable	Jan Syski
cpe:2.3:a:smod:smodbip::::::::	up to 2.21	Vulnerable	Smod

cpe:2.3:a:megabip:megabip:*:*:*:*:*:*:*:* Versions up to 4.36.2 Vulnerable ·Jan Syski
cpe:2.3:a:smod:smodbip:*:*:*:*:*:*:*:* Versions up to 2.21 Vulnerable ·Smod

Remediation

Fix · CNA MegaBIP (Jan Syski) Fixed in 5.08

Timeline

2026-10-02 Threatist record created from CVE-2023-5378
2026-10-03 Alias added: GHSA-9w3h-593p-q56r

References

Advisory 2

Other 2

TI-2024-01473 Remote Code Execution in MegaBIP CVSS 4.0CRITICAL 9.3
TI-2024-01542 Arbitrary File Upload in MegaBIP CVSS 4.0CRITICAL 9.3
TI-2024-01472 SQL Injection in MegaBIP CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences