Read the docs
TI-2023-13476 Aliases CVE-2023-29015GHSA-622w-995c-3c3h

Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. The vulnerability has been fixed in version 23.03.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00443 38th percentileScored 2026-11-07
Fix Fixed goobi-viewer-core (intranda): 23.03io.goobi.viewer:viewer-core (Maven): 23.03

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
intrandagoobi-viewer-corebefore 23.0323.03Patch availableCNA
—io.goobi.viewer:viewer-core (Maven)before 23.0323.03Patch availableGHSA-622w-995c-3c3h
  • goobi-viewer-core Vendorintranda Affected before 23.03 Fixed in 23.03 Patch available CNA
  • io.goobi.viewer:viewer-core (Maven) Vendor— Affected before 23.03 Fixed in 23.03 Patch available GHSA-622w-995c-3c3h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:*before 23.03Vulnerableintranda
  • cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:* Versions before 23.03 Vulnerable ·intranda

Remediation

  • Fix · CNA goobi-viewer-core (intranda) Fixed in 23.03
  • Fix · GHSA-622w-995c-3c3h io.goobi.viewer:viewer-core (Maven) Fixed in 23.03 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29015
  2. 2026-10-03 Alias added: GHSA-622w-995c-3c3h

References

Patch 1

Advisory 2

Other 1

  • TI-2020-11897 Path traversal in Goobi viewer Core CVSS 3.1CRITICAL 9.6
  • TI-2023-13477 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames CVSS 3.1MEDIUM 6.1
  • TI-2023-13475 Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences