CraftCMS stored XSS in Quick Post widget error message
CVE-2023-33194

4.8MEDIUM

Key Information:

Vendor
craftcms
Status
cms
Vendor
CVE Published:
26 May 2023

Summary

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.

Affected Version(s)

cms >= 4.0.0-RC1, < 4.4.6 < 4.0.0-RC1, 4.4.6

cms >= 3.0.0, <= 3.8.5 <= 3.0.0, 3.8.5

References

https://github.com/craftcms/cms/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3...
x_refsource_MISC
https://github.com/craftcms/cms/releases/tag/4.4.6
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.