Cross Site Scripting Vulnerability in Craft CMS Audit Plugin
CVE-2023-36259

5.4MEDIUM

Key Information:

Vendor

Craftcms

Status
Craft Cms
Vendor
CVE Published:
30 January 2024

What is CVE-2023-36259?

A Cross Site Scripting (XSS) vulnerability exists in Craft CMS Audit Plugin, specifically in versions before 3.0.2. This flaw allows attackers to execute arbitrary code at the moment of user creation, leading to potential unauthorized access or manipulation of sensitive data. Website administrators using the affected plugin are urged to implement necessary security measures and upgrade to the latest version to mitigate risks associated with this vulnerability.

References

https://github.com/sjelfull/craft-audit/pull/73
https://www.linkedin.com/pulse/threat-briefing-craftcms-a...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.