Vulnerability · Published May 26, 2023 · Assigned by GitHub_M
CVE-2023-33194CraftCMS stored XSS in Quick Post widget error message
Low 3.7
In plain English
A low-severity security flaw in cms from craftcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.6%top 50.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | craftcms/cms | 4.4.6 | GHSA-3wxg-w96j-8hq9 |
| Packagist | craftcms/cms | 3.8.6 | GHSA-3wxg-w96j-8hq9 |
Affected products (as reported)
Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
References
- https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9 x_refsource_CONFIRM
- https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888 x_refsource_MISC
- https://github.com/craftcms/cms/releases/tag/4.4.6 x_refsource_MISC