medium5.4
CVE-2023-36259
Craft CMS Audit Plugin Cross Site Scripting vulnerability
Impact
Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | superbig/craft-audit | < 3.0.2 | 3.0.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Craftcms | Craft Cms | before 3.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/sjelfull/craft-audit/pull/73
- https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D
- https://github.com/advisories/GHSA-v89q-c273-3p42
- https://nvd.nist.gov/vuln/detail/CVE-2023-36259
- https://github.com/sjelfull/craft-audit/commit/c2888aa48457f24696ac0a2ba4f54f39e5c672ed