medium5.4
CVE-2023-2817
Stored cross site scripting in Craft CMS
Impact
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively. This issue was patched in version 4.4.12.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | craftcms/cms | >= 4.0.0-RC1, < 4.4.12 | 4.4.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Craftcms | Craft Cms | through 4.4.11 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb
- https://www.tenable.com/security/research/tra-2023-20%2C
- https://github.com/advisories/GHSA-7x94-jx75-3gh6
- https://nvd.nist.gov/vuln/detail/CVE-2023-2817
- https://www.tenable.com/security/research/tra-2023-20