CVE-2023-45879: 
NixOS vulnerability analysis and mitigation

GibbonEdu Gibbon version 25.0.0 contains an HTML Injection vulnerability that affects the Messager component. The vulnerability was discovered on June 27, 2023, and was patched in version 25.0.01 released on September 19, 2023. The issue allows HTML Injection via an IFRAME element, which can be exploited by users with messaging permissions (USD Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 Base Score of 5.4 (MEDIUM). The attack vector is Network-based (AV:N) with Low attack complexity (AC:L), requiring Low privileges (PR:L) and User interaction (UI:R). The scope is Changed (S:C) with Low confidentiality (C:L) and integrity (I:L) impacts, and No availability impact (A:N) (NVD).

A user with messaging permissions can inject an iframe into the application, which can be used to abuse XSS/CSRF vulnerabilities in the admin backend. This could potentially lead to the creation of new admin users when a malicious message is opened by an existing admin user (USD Advisory).

The vulnerability has been fixed in version 25.0.01, released as a security update on September 19, 2023. The vendor recommends treating all input on the website as potentially dangerous (USD Advisory).