{"id":"CVE-2023-38878","details":"A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious payload into the 'error' and 'error_description' parameters of 'oauth2.php'.","modified":"2026-08-12T03:51:46.890941335Z","published":"2023-09-11T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38878.json"},"references":[{"type":"WEB","url":"https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38878"},{"type":"WEB","url":"https://openstamanager.com/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38878.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38878"},{"type":"PACKAGE","url":"https://github.com/devcode-it/openstamanager"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/devcode-it/openstamanager","events":[{"introduced":"016dfdf09866e82887f82457ed1f26496ead7093"},{"last_affected":"bfd4794fd4a5301e70ab06284431f32ba4aa7afb"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:devcode:openstamanager:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.4.24"},{"last_affected":"2.4.47"}]}}],"versions":["v2.4.47","v2.4.44","v2.4.43","v2.4.42","v2.4.41","v2.4.40","v2.4.38","v2.4.32","v2.4.28","v2.4.25","v2.4.24"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-38878.json"}}],"schema_version":"1.9.0"}