Cross-Site Scripting Vulnerability in Craft CMS by Pixel & Tonic
CVE-2022-28378

6.1MEDIUM

Key Information:

Vendor

Craftcms

Status
Craft Cms
Vendor
CVE Published:
3 April 2022

What is CVE-2022-28378?

Craft CMS prior to version 3.7.29 is susceptible to a Cross-Site Scripting (XSS) vulnerability, which enables attackers to inject malicious scripts into web pages viewed by users. This could lead to unauthorized actions being performed on behalf of users or sensitive information being compromised. It's crucial for users of affected versions to update to the latest release to mitigate this risk.

References

https://github.com/craftcms/cms/blob/develop/CHANGELOG.md...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2022-28378 : Cross-Site Scripting Vulnerability in Craft CMS by Pixel & Tonic