CVE-2023-33387

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-22 · updated 2026-06-17
Weakness: CWE-79

Description

A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link.

Affected products

Datev Eg Personal-Management System Comfort/Comfort Plus: from 15.1.0 before 16.1.1; 16.1.1, 16.1.1-p1, 16.1.1-p2, 16.1.1-p3, 16.1.1-p4 — fixed in 16.1.1

How to fix

Upgrade to a fixed version: Datev Eg Personal-Management System Comfort/Comfort Plus 16.1.1. Check the vendor advisory for mitigations.

References

https://apps.datev.de/help-center/documents/1021479
https://support.veda.net/datev.php
https://www.tuv.com/landingpage/de/schwachstelle/
https://apps.datev.de/help-center/documents/1021479
https://support.veda.net/datev.php
https://www.tuv.com/landingpage/de/schwachstelle/

Get alerted when CVE-2023-33387 or the next vulnerability affects your stack