Lucene search

GitHub Advisory DatabaseGHSA-F3XR-Q258-H7M9

HistoryMay 24, 2022 - 4:58 p.m.

Craft CMS XSS Vulnerability

2022-05-2416:58:38

CWE-79

GitHub Advisory Database

github.com

craft cms

xss

stored xss

name field

site deletion

security vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

36.1%

JSON

Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.

Affected configurations

Vulners

Node

craftcmscmsRange<3.3.8

VendorProductVersionCPE
craftcmscms*cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
craftcms	cms	*	cpe:2.3:a:craftcms:cms::::::::

References

github.com/advisories/GHSA-f3xr-q258-h7m9

github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09

github.com/craftcms/cms/commit/0ee66d29281af2b6c4f866e1437842c61983a672

nvd.nist.gov/vuln/detail/CVE-2019-17496

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

36.1%

JSON

Related for GHSA-F3XR-Q258-H7M9