Read the docs
TI-2023-09648 Aliases CVE-2023-23849GHSA-7gvj-8qmv-p4vc

Cross-site scripting in Synopsys Coverity

Priority MEDIUM 40CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole subdomain which can be used to bypass other mitigations in place for malicious purposes. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/RL:O/RC:C

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01298 70th percentileScored 2026-11-07
Fix Fixed Coverity (Synopsys): 2022.12.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SynopsysCoveritybefore 2022.12.02022.12.0Patch availableCNA
  • Coverity VendorSynopsys Affected before 2022.12.0 Fixed in 2022.12.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:synopsys:coverity:*:*:*:*:*:*:*:*before 2022.12.0VulnerableSynopsys
  • cpe:2.3:a:synopsys:coverity:*:*:*:*:*:*:*:* Versions before 2022.12.0 Vulnerable ·Synopsys

Remediation

  • Fix · CNA Coverity (Synopsys) Fixed in 2022.12.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23849
  2. 2026-10-03 Alias added: GHSA-7gvj-8qmv-p4vc

References

Advisory 1

  • TI-2023-01560 Authenticated Resources Accessible via Forced Browsing CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences