CVE-2023-42431: Hallowelt Bluespice

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context.

Affected products

• Hallowelt Bluespice: from 3.0, before 3.2.10.1 (fixed in 3.2.10.1); from 4.0, before 4.3.3 (fixed in 4.3.3)

Published 2023-10-30. Last modified 2026-06-17.