PatchTheCVECVE-2023-2862: A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1
CVE-2023-2862 is a low-severity flaw (CVSS 3.5) affecting siteserver cms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Affected is an unknown function of the file /api/stl/actions/search. The manipulation of the argument ajaxDivId leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-229818 is the identifier assigned to this vuln
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.5 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.6% (top 53%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2023-05-24 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-2862?
siteserver cms: upgrade to newer than 7.2.1. Exact commands for each OS are on this page.
Is CVE-2023-2862 being exploited?
CVE-2023-2862 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-2862 affect?
CVE-2023-2862 affects siteserver cms. Severity is low (CVSS 3.5). A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Affected is an unknown function of the file /api/stl/actions/search. The manipulation of the argument ajaxDivId leads to cross site scripting. It
How urgent is CVE-2023-2862?
Priority 29/100. Public exploit reference
Related CVEs
- CVE-2022-28118 CRITICAL 9.8 UPGRADE SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.
- CVE-2025-45529 HIGH 7.1 DOWNGRADE An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to
- CVE-2022-44299 MEDIUM 4.9 DOWNGRADE SiteServerCMS 7.1.3 sscms has a file read vulnerability.
- CVE-2022-44298 CRITICAL 9.8 DOWNGRADE SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
- CVE-2022-44297 CRITICAL 9.8 DOWNGRADE SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.