VulnerabilityModified
CVE-2023-33194
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload.
MEDIUM 4.8EPSS 0.62%
Does this matter?
Lower severity and a low EPSS score (0.62%). Track it; it rarely justifies an emergency change on its own.
Description
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.62% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-80, CWE-79
- Affected
- craftcms/craft cms · craftercms/craftercms
- Source
- security-advisories@github.com
References
- https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888Patch
- https://github.com/craftcms/cms/releases/tag/4.4.6Release Notes
- https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9Exploit
- https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888Patch
- https://github.com/craftcms/cms/releases/tag/4.4.6Release Notes
- https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.