Craft CMS Stored Cross-site Scripting Injection Vulnerability · CVE-2023-23927 · GitHub Advisory Database · GitHub

Craft CMS Stored Cross-site Scripting Injection Vulnerability

Moderate severity GitHub Reviewed Published Mar 3, 2023 in craftcms/cms • Updated Mar 7, 2023

Package

craftcms/cms (Composer)

Affected versions

>= 4.0.0-RC1, < 4.3.7

>= 3.7.24, < 3.7.64

Patched versions

4.3.7

3.7.64

Description

Summary

When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the
admin dashboard.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

Impact

Tested with the free version of Craft CMS 4.3.6.1

References

angrybrad published to craftcms/cms

Mar 3, 2023

Published by the National Vulnerability Database

Mar 3, 2023

Published to the GitHub Advisory Database Mar 3, 2023

Reviewed Mar 3, 2023

Last updated Mar 7, 2023

Severity

Moderate

6.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N