{"id":"CVE-2023-7238","aliases":["EUVD-2023-59419","GHSA-rv57-pvch-f98r"],"status":"published","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer","description":"A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00308,"percentile":0.23837,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-01-23T19:20:02Z","modified":"2026-06-17T06:52:23Z","products":[{"vendor":"orthanc","product":"osimis dicom web viewer"},{"vendor":"orthanc-server","product":"osimis_web_viewer"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01","tags":["government-resource","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7238"},{"url":"https://github.com/advisories/GHSA-rv57-pvch-f98r"}],"sources":{"cve":[{"id":"CVE-2023-7238","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer","description":"\nA XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.\n\n","status":"published","published":"2024-01-23T19:20:02.324Z","modified":"2025-06-17T21:19:26.897Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:33.794347Z"}],"euvd":[{"id":"EUVD-2023-59419","description":"\nA XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.\n\n","status":"published","published":"2024-01-23T19:20:02Z","modified":"2025-06-17T21:19:26Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:32:21.000623Z"}],"ghsa":[{"id":"GHSA-rv57-pvch-f98r","title":"\nA XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study...","description":"\nA XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.\n\n","status":"published","published":"2024-01-23T21:30:20Z","modified":"2024-01-23T21:30:27Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:55:28.44427Z"}],"nvd":[{"id":"CVE-2023-7238","description":"\nA XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.\n\n","status":"published","published":"2024-01-23T20:15:45.413Z","modified":"2026-06-17T06:52:23.053Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:01.900189Z"}]}}