CVE-2023-33194

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:-:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:rc3:*:*:*:*:*:*

History

02 Jun 2023, 18:43

Type Values Removed Values Added
References (MISC) https://github.com/craftcms/cms/releases/tag/4.4.6 - (MISC) https://github.com/craftcms/cms/releases/tag/4.4.6 - Release Notes
References (MISC) https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888 - (MISC) https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888 - Patch
References (MISC) https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9 - (MISC) https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9 - Exploit
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 4.8
First Time Craftcms
Craftercms craftercms
Craftcms craft Cms
Craftercms
CPE cpe:2.3:a:craftercms:craftercms:4.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:-:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:rc2:*:*:*:*:*:*
CWE CWE-79

26 May 2023, 21:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-05-26 21:15

Updated : 2024-02-28 20:13


NVD link : CVE-2023-33194

Mitre link : CVE-2023-33194

CVE.ORG link : CVE-2023-33194


JSON object : View

Products Affected

craftercms

  • craftercms

craftcms

  • craft_cms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)