CVE-2023-33195 Craft CMS XSS in RSS widget feed

2023-05-2703:51:35

CWE-79

GitHub_M

www.cve.org

craft cms

rss widget

xss

web security

version 4.4.6

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

0.001

Percentile

32.9%

JSON

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.

CNA Affected

[
  {
    "vendor": "craftcms",
    "product": "cms",
    "versions": [
      {
        "version": ">= 4.3.0, <= 4.4.5",
        "status": "affected"
      }
    ]
  }
]