CVE-2023-33194CWE-80

CraftCMS stored XSS in Quick Post widget error message

Low · published May 26, 2023

CVSS v3.1
3.7
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00617 · 48.9th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2023-05-26T20:30Z
EPSS history
Timeline
  • 26 MAY 20:30Z
    CraftCMS stored XSS in Quick Post widget error message
    cvelistv5