TI-2023-23796 Aliases CVE-2023-44272 GHSA-j24p-mq7x-2jwp

Cross-site scripting in Citadel

LOW 25CWE-79Published 2023-10-04 · Updated 2024-09-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A cross-site scripting vulnerability exists in Citadel versions prior to 994. When a malicious user sends an instant message with some JavaScript code, the script may be executed on the web browser of the victim user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00534 45th percentileScored 2026-11-07

Fix Fixed Citadel (Citadel): 994

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Citadel	Citadel	before 994	994	Patch available	CNA

Citadel VendorCitadel Affected before 994 Fixed in 994 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:citadel:citadel::::::::	before 994	Vulnerable	Citadel

cpe:2.3:a:citadel:citadel:*:*:*:*:*:*:*:* Versions before 994 Vulnerable ·Citadel

Remediation

Fix · CNA Citadel (Citadel) Fixed in 994

Timeline

2026-10-02 Threatist record created from CVE-2023-44272
2026-10-03 Alias added: GHSA-j24p-mq7x-2jwp

References

Patch 1

https://code.citadel.org/citadel/citadel/-/commit/f0dac5ff074ad686fa71ea663c8ead107bd3041e

Advisory 1

https://jvn.jp/en/jp/JVN08237727/

Other 2

TI-2011-01535 modules/xmpp/serv_xmpp.c in Citadel 7.86 and earlier does not properly detect recursion… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences