GitHub Advisoryadvisory · Maven

GHSA-jfm4-3vv3-fm4v Cross-site Scripting (XSS) in CrafterCMS

HIGH Published 2023-08-03 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-4136
Ecosystem
Maven
Packages
org.craftercms:crafter-engine
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-79
Reviewed
2025-02-13

Affected packages

• Maven org.craftercms:crafter-engine: >= 4.0.0, < 4.0.3 → fixed in 4.0.3 • Maven org.craftercms:crafter-engine: >= 3.1.0, < 3.1.28 → fixed in 3.1.28

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.

Related

Alias · CVE (1)

  • CVE-2023-4136 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS,… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References