Lucene search

GitHub Advisory DatabaseGHSA-J4MX-98HW-6RV6

HistoryMay 05, 2023 - 11:13 p.m.

craftcms/cms vulnerable to cross site scripting in RSS feed widget

2023-05-0523:13:02

CWE-79

GitHub Advisory Database

github.com

craftcms

xss

vulnerability

patched

rss feed

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

32.5%

JSON

A malformed title in the feed widget of craftcms/cms can deliver an XSS payload. This has been resolved in this commit.

Affected configurations

Vulners

Node

craftcmscraft_cmsRange≤4.4.3

craftcmscraft_cmsRange≤3.8.3

CPENameOperatorVersion
craftcms/cmsle4.4.3
craftcms/cmsle3.8.3

CPE	Name	Operator	Version
	craftcms/cms	le	4.4.3
	craftcms/cms	le	3.8.3

References

github.com/advisories/GHSA-j4mx-98hw-6rv6

github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442

github.com/craftcms/cms/commit/e2f7e7b7d86a0afa54ce855375d13c7760670764

github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6

nvd.nist.gov/vuln/detail/CVE-2023-31144

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

32.5%

JSON

Related for GHSA-J4MX-98HW-6RV6