PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-6673 National Keep Cyber Security Services CVE debrief

CVE-2023-6673 is a reflected cross-site scripting (XSS) vulnerability in National Keep CyberMath. According to the published records, CyberMath versions from 1.4 before 1.5 are affected. The issue is rated CVSS 6.1 (medium) and is associated with CWE-79. Organizations running CyberMath 1.4 should prioritize upgrading to 1.5 or later and review any web paths that reflect user-supplied input.

Vendor
National Keep Cyber Security Services
Product
CyberMath
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2024-02-02
Original CVE updated
2026-05-20
Advisory published
2024-02-02
Advisory updated
2026-05-20

Who should care

Security and application teams responsible for CyberMath deployments, especially if version 1.4 is in use. Web developers and defenders who manage input handling, output encoding, and browser-facing application controls should also review this issue.

Technical summary

The available records describe an improper neutralization of input during web page generation that enables reflected XSS. The NVD entry lists the affected CPE as nationalkeep:cybermath:1.4, with vulnerability coverage ending before 1.5. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network reachability, low attack complexity, no privileges required, and user interaction required. The weakness classification is CWE-79.

Defensive priority

Medium priority for any environment running CyberMath 1.4. Because exploitation depends on user interaction but can affect confidentiality and integrity through browser-side execution, remediation should be scheduled promptly, with upgrade as the preferred fix.

Recommended defensive actions

  • Upgrade CyberMath from version 1.4 to version 1.5 or later.
  • Audit any pages or parameters that echo user-controlled input and ensure context-aware output encoding is applied.
  • Review input validation and server-side sanitization for all web-facing fields tied to CyberMath functionality.
  • Add or update regression tests that verify reflected input is not rendered as executable HTML or script.
  • Monitor for suspicious requests against affected web endpoints until the upgrade is completed.

Evidence notes

This debrief is based on the official CVE record and NVD detail for CVE-2023-6673, plus the referenced USOM/Siber Guvenlik advisory links. The source data identifies the issue as reflected XSS, maps it to CWE-79, provides the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and lists CyberMath 1.4 as vulnerable before 1.5. The CVE was published on 2024-02-02 and later modified on 2026-05-20; that modified date is not treated as the original issue date.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-6673 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-6673

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-6673 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-6673

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.