HTML Injection Vulnerability in Craft CMS by Pixel & Tonic
CVE-2023-33495
6.1MEDIUM
Summary
Craft CMS versions up to 4.4.9 are vulnerable to HTML Injection, which allows attackers to insert arbitrary HTML code into the application's output. This can lead to various security risks, including the manipulation of web content, phishing attacks, or the execution of malicious scripts in the user's browser. Proper sanitization and validation of user inputs are essential to mitigate this risk and enhance the overall security posture of applications using Craft CMS.
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved