CVE-2023-33194
CraftCMS stored XSS in Quick Post widget error message
Impact
### Summary The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. ### Details Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. ### PoC 1. Login at admin 2. Go to setting 3. Create a Section 4. On Entry page, click Edit label 5. Inject the XSS payload into the label and save 6. On the admin dashboard choose new widget -> Quick Post 7. In Quick Post, click save with blank slug; The XSS will be executed "errors":{"title":["<script>alert('nono')</script> cannot be blank."],"slug":["Slug cannot be blank."] Fixed in https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | craftcms/cms | >= 4.0.0-RC1, < 4.4.6 | 4.4.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Craftcms | Craft Cms | from 3.0.0 before 3.8.6 from 4.0.1 before 4.4.6 |
| Craftercms | Craftercms | Version 4.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888
- https://github.com/craftcms/cms/releases/tag/4.4.6
- https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9
- https://github.com/advisories/GHSA-3wxg-w96j-8hq9
- https://nvd.nist.gov/vuln/detail/CVE-2023-33194