Lucene search

GoogleOSV:GHSA-V89Q-C273-3P42

HistoryJan 30, 2024 - 9:30 a.m.

Craft CMS Audit Plugin Cross Site Scripting vulnerability

2024-01-3009:30:34

Google

osv.dev

craft cms

audit plugin

cross site scripting

arbitrary code execution

user creation

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.4%

JSON

Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.

CPENameOperatorVersion
superbig/craft-auditeq3.0.0
superbig/craft-auditeq1.0.3
superbig/craft-auditeq1.0.0
superbig/craft-auditeq1.1.2
superbig/craft-auditeq1.0.1
superbig/craft-auditeq3.0.1
superbig/craft-auditeq1.1.3
superbig/craft-auditeq1.0.4
superbig/craft-auditeq1.1.1
superbig/craft-auditeq1.0.2

Name	Operator	Version
superbig/craft-audit	eq	3.0.0
superbig/craft-audit	eq	1.0.3
superbig/craft-audit	eq	1.0.0
superbig/craft-audit	eq	1.1.2
superbig/craft-audit	eq	1.0.1
superbig/craft-audit	eq	3.0.1
superbig/craft-audit	eq	1.1.3
superbig/craft-audit	eq	1.0.4
superbig/craft-audit	eq	1.1.1
superbig/craft-audit	eq	1.0.2

References

github.com/sjelfull/craft-audit

github.com/sjelfull/craft-audit/commit/c2888aa48457f24696ac0a2ba4f54f39e5c672ed

github.com/sjelfull/craft-audit/pull/73

nvd.nist.gov/vuln/detail/CVE-2023-36259

www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D