Vulnerability · Published Aug 3, 2023 · Assigned by crafter

CVE-2023-4136Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine

High 7.4

In plain English

A high-severity cross-site scripting in CrafterCMS from CrafterCMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)1.4%top 27.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.craftercms:crafter-engine	4.0.3	GHSA-jfm4-3vv3-fm4v
Maven	org.craftercms:crafter-engine	3.1.28	GHSA-jfm4-3vv3-fm4v

Affected products (as reported)

Vendor	Product	Versions
CrafterCMS	CrafterCMS	4.0.0 – through 4.0.23.1.0 – through 3.1.27

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References