HTML Injection Vulnerability in Craft CMS by Pixel & Tonic
CVE-2023-33495

6.1MEDIUM

Key Information:

Vendor

Craftcms

Status
Craft Cms
Vendor
CVE Published:
20 June 2023

What is CVE-2023-33495?

Craft CMS versions up to 4.4.9 are vulnerable to HTML Injection, which allows attackers to insert arbitrary HTML code into the application's output. This can lead to various security risks, including the manipulation of web content, phishing attacks, or the execution of malicious scripts in the user's browser. Proper sanitization and validation of user inputs are essential to mitigate this risk and enhance the overall security posture of applications using Craft CMS.

References

https://owasp.org/www-project-web-security-testing-guide/...
https://medium.com/%40mondalsomnath9135/html-injection-in...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.