PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-1726 Proliz CVE debrief

CVE-2023-1726 is a stored cross-site scripting issue in Proliz OBS, affecting versions before 23.04.01. According to the published record, the flaw impacts authenticated users and is categorized as CWE-79. The NVD vector shows network-based exploitation with low attack complexity, low privileges required, user interaction required, and limited confidentiality/integrity impact (CVSS 3.1: 5.4 MEDIUM). Defenders should treat this as a prompt remediation item for any deployed OBS instance that accepts and later renders user-controlled content.

Vendor
Proliz
Product
OBS
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2023-04-07
Original CVE updated
2024-11-21
Advisory published
2023-04-07
Advisory updated
2024-11-21

Who should care

System administrators, application owners, and security teams responsible for Proliz OBS deployments should care most, especially if the application is accessible to multiple authenticated users or handles user-generated content.

Technical summary

The source record describes an improper neutralization of input during web page generation that can result in stored XSS. In practical terms, an authenticated user can supply content that is later rendered in a browser without sufficient output encoding or sanitization, allowing script execution in the context of another user’s session. The affected version range ends before 23.04.01, and the NVD reference ties the issue to CWE-79 with a CVSS vector of AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Defensive priority

Medium priority, but patch promptly if the system is user-facing or supports multiple authenticated roles. Stored XSS can be used to manipulate sessions, content, or user actions even when availability is not directly impacted.

Recommended defensive actions

  • Upgrade Proliz OBS to version 23.04.01 or later, which is the first fixed version named in the source record.
  • Review all authenticated input paths that are rendered back into web pages and ensure context-appropriate output encoding is applied.
  • Audit templates and rich-text or comment fields for stored content that may be reflected without sanitization.
  • Restrict unnecessary authenticated write access and apply least privilege to roles that can create or edit content.
  • Monitor for suspicious script-like payloads in application logs and review affected user sessions if abuse is suspected.

Evidence notes

The CVE description states that Proliz OBS has a stored XSS vulnerability for an authenticated user and that the issue affects versions before 23.04.01. The NVD metadata provides the affected CPE range ending before 23.04.01 and a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The supplied third-party advisory URL is USOM reference TR-23-0205. No CISA KEV entry is present in the supplied data.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-1726 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-1726

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-1726 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-1726

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.