CVE-2023-33195

Опубликовано: 27 мая 2023

Источник: nvd

CVSS3: 5

CVSS3: 6.1

EPSS Низкий

Описание

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.

Ссылки

https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f
Patch
https://github.com/craftcms/cms/releases/tag/4.4.6
https://github.com/craftcms/cms/security/advisories/GHSA-qpgm-gjgf-8c2x
Exploit
Patch
Vendor Advisory
https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f
Patch
https://github.com/craftcms/cms/releases/tag/4.4.6
https://github.com/craftcms/cms/security/advisories/GHSA-qpgm-gjgf-8c2x
Exploit
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*

Версия от 4.3.0 (включая) до 4.4.6 (исключая)

EPSS

Процентиль: 67%

0.0055

Низкий

5 Medium

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-qpgm-gjgf-8c2x

CVSS3: 6.1

github

больше 2 лет назад

Craft CMS XSS in RSS widget feed

EPSS

Процентиль: 67%

0.0055

Низкий

5 Medium

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-79