CVE-2023-33194

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:-:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:rc3:*:*:*:*:*:*

History

21 Nov 2024, 08:05

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 4.8
v2 : unknown
v3 : 3.7
References () https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888 - Patch () https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888 - Patch
References () https://github.com/craftcms/cms/releases/tag/4.4.6 - Release Notes () https://github.com/craftcms/cms/releases/tag/4.4.6 - Release Notes
References () https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9 - Exploit () https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9 - Exploit

02 Jun 2023, 18:43

Type Values Removed Values Added
First Time Craftcms
Craftercms craftercms
Craftcms craft Cms
Craftercms
CPE cpe:2.3:a:craftercms:craftercms:4.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:-:*:*:*:*:*:*
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:craftercms:craftercms:4.0.0:rc2:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 4.8
CWE CWE-79
References (MISC) https://github.com/craftcms/cms/releases/tag/4.4.6 - (MISC) https://github.com/craftcms/cms/releases/tag/4.4.6 - Release Notes
References (MISC) https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888 - (MISC) https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888 - Patch
References (MISC) https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9 - (MISC) https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9 - Exploit

26 May 2023, 21:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-05-26 21:15

Updated : 2024-11-21 08:05


NVD link : CVE-2023-33194

Mitre link : CVE-2023-33194

CVE.ORG link : CVE-2023-33194


JSON object : View

Products Affected

craftcms

  • craft_cms

craftercms

  • craftercms
CWE
CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')