CVEvulnerability

CVE-2023-33194

4.8 MEDIUM Published 2023-05-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-05-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
CVSS 3.1 ([email protected])
4.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79, CWE-80

Description

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.

Affected configurations

• craftcms craft cms (>= 3.0.0 < 3.8.6) • craftcms craft cms (>= 4.0.1 < 4.4.6) • craftercms craftercms 4.0.0

Related

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References