CVE-2023-23927

Опубликовано: 03 мар. 2023

Источник: nvd

CVSS3: 6.1

CVSS3: 5.4

EPSS Низкий

Описание

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.

Ссылки

https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03
Release Notes
https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq
Exploit
Vendor Advisory
https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4
Exploit
Third Party Advisory
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03
Release Notes
https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq
Exploit
Vendor Advisory
https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*

Версия до 4.3.7 (исключая)

EPSS

Процентиль: 93%

0.0955

Низкий

6.1 Medium

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-qcrj-6ffc-v7hq

CVSS3: 6.1

github

почти 3 года назад

Craft CMS Stored Cross-site Scripting Injection Vulnerability

EPSS

Процентиль: 93%

0.0955

Низкий

6.1 Medium

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79