Read the docs
TI-2023-13477 Aliases CVE-2023-29016GHSA-2r9r-8fcg-m38g

Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when using nicknames. An attacker could create a user account and enter malicious scripts into their profile's nickname, resulting in the execution in the user's browser when displaying the nickname on certain pages. The vulnerability has been fixed in version 23.03.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00443 38th percentileScored 2026-11-07
Fix Fixed goobi-viewer-core (intranda): 23.03io.goobi.viewer:viewer-core (Maven): 23.03

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
intrandagoobi-viewer-corebefore 23.0323.03Patch availableCNA
—io.goobi.viewer:viewer-core (Maven)before 23.0323.03Patch availableGHSA-2r9r-8fcg-m38g
  • goobi-viewer-core Vendorintranda Affected before 23.03 Fixed in 23.03 Patch available CNA
  • io.goobi.viewer:viewer-core (Maven) Vendor— Affected before 23.03 Fixed in 23.03 Patch available GHSA-2r9r-8fcg-m38g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:*before 23.03Vulnerableintranda
  • cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:* Versions before 23.03 Vulnerable ·intranda

Remediation

  • Fix · CNA goobi-viewer-core (intranda) Fixed in 23.03
  • Fix · GHSA-2r9r-8fcg-m38g io.goobi.viewer:viewer-core (Maven) Fixed in 23.03 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29016
  2. 2026-10-03 Alias added: GHSA-2r9r-8fcg-m38g

References

Patch 1

Advisory 2

Other 1

  • TI-2020-11897 Path traversal in Goobi viewer Core CVSS 3.1CRITICAL 9.6
  • TI-2023-13476 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments CVSS 3.1MEDIUM 6.1
  • TI-2023-13475 Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences