Read the docs
TI-2023-13475 Aliases CVE-2023-29014GHSA-7v7g-9vx6-vcg2

Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. The vulnerability has been fixed in version 23.03.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00443 38th percentileScored 2026-11-07
Fix Fixed goobi-viewer-core (intranda): 23.03io.goobi.viewer:viewer-core (Maven): 23.03

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
intrandagoobi-viewer-corebefore 23.0323.03Patch availableCNA
—io.goobi.viewer:viewer-core (Maven)before 23.0323.03Patch availableGHSA-7v7g-9vx6-vcg2
  • goobi-viewer-core Vendorintranda Affected before 23.03 Fixed in 23.03 Patch available CNA
  • io.goobi.viewer:viewer-core (Maven) Vendor— Affected before 23.03 Fixed in 23.03 Patch available GHSA-7v7g-9vx6-vcg2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:*before 23.03Vulnerableintranda
  • cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:* Versions before 23.03 Vulnerable ·intranda

Remediation

  • Fix · CNA goobi-viewer-core (intranda) Fixed in 23.03
  • Fix · GHSA-7v7g-9vx6-vcg2 io.goobi.viewer:viewer-core (Maven) Fixed in 23.03 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29014
  2. 2026-10-03 Alias added: GHSA-7v7g-9vx6-vcg2

References

Patch 1

Advisory 2

Other 1

  • TI-2020-11897 Path traversal in Goobi viewer Core CVSS 3.1CRITICAL 9.6
  • TI-2023-13477 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames CVSS 3.1MEDIUM 6.1
  • TI-2023-13476 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences