CVE-2023-31144 Craft CMS vulnerable to cross site scripting in RSS feed widget

2023-05-0915:22:39

CWE-79

GitHub_M

www.cve.org

cve-2023-31144

craft cms

cross-site scripting

rss feed widget

version 3.8.4

version 4.4.4

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

32.5%

JSON

Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.

CNA Affected

[
  {
    "vendor": "craftcms",
    "product": "cms",
    "versions": [
      {
        "version": ">= 3.0.0, < 3.8.4",
        "status": "affected"
      },
      {
        "version": ">= 4.0.0, < 4.4.4",
        "status": "affected"
      }
    ]
  }
]