PatchTheCVECVE-2023-4497: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulti
CVE-2023-4497 is a medium-severity flaw (CVSS 6.1) affecting easy chat server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Icon parameter. The XSS is loaded from /users.ghp.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.4% (top 63%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2023-10-04 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-4497?
easy chat server: upgrade to newer than 3.1. Exact commands for each OS are on this page.
Is CVE-2023-4497 being exploited?
CVE-2023-4497 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-4497 affect?
CVE-2023-4497 affects easy chat server. Severity is medium (CVSS 6.1). Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Icon parameter. The XSS is loa
How urgent is CVE-2023-4497?
Priority 30/100. No elevated risk signals yet.
Related CVEs
- CVE-2024-0695 MEDIUM 4.3 DOWNGRADE A vulnerability, which was classified as problematic, has been found in EFS Easy Chat Server 3.1
- CVE-2023-4496 MEDIUM 6.1 UPGRADE Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulti
- CVE-2023-4495 MEDIUM 6.1 UPGRADE Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulti
- CVE-2023-4494 CRITICAL 9.8 DOWNGRADE Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version
- CVE-2019-25613 HIGH 7.5 DOWNGRADE Easy Chat Server 3.1 contains a denial of service vulnerability that allows remote attackers to crash the appl