PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-3653 Digital Ant CVE debrief

CVE-2023-3653 is a stored cross-site scripting (XSS) vulnerability in Digital Ant E-Commerce Software affecting versions before 11. The NVD record classifies it as CWE-79 and assigns CVSS 3.1 5.4/Medium with network attack, low privileges, and user interaction required.

Vendor
Digital Ant
Product
E-Commerce Software
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2023-08-08
Original CVE updated
2026-05-21
Advisory published
2023-08-08
Advisory updated
2026-05-21

Who should care

Organizations running Digital Ant E-Commerce Software before version 11 should care, especially security teams, administrators, and developers responsible for pages that store or display user-controlled content. Any workflow that renders attacker-supplied input in a browser-facing page is relevant.

Technical summary

The official NVD record maps this issue to CWE-79 and shows the vulnerable version boundary ending before 11. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates a network-reachable issue that requires low privileges and victim interaction, consistent with stored XSS in web page generation.

Defensive priority

Medium — patch promptly if the software is deployed in production, especially on user-facing or admin-facing pages where stored content is rendered in browsers.

Recommended defensive actions

  • Upgrade Digital Ant E-Commerce Software to version 11 or later.
  • Inventory all deployments to confirm whether any instance is running a version earlier than 11.
  • Review pages that accept, store, or render user-controlled input and ensure proper output encoding/HTML sanitization is in place.
  • Limit which low-privilege users can submit content that is later displayed to other users.
  • Re-test affected pages after upgrading to confirm the stored XSS condition is no longer present.
  • Monitor vendor and USOM advisories for additional remediation guidance or related notices.

Evidence notes

This debrief is based only on the supplied official NVD record and linked advisories. The corpus states the issue is a stored XSS affecting Digital Ant E-Commerce Software before version 11, with CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N and weakness CWE-79. No KEV listing is present in the supplied data.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-3653 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-3653

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-3653 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-3653

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.