GitHub Advisoryadvisory · Packagist

GHSA-xrf8-cmrg-7436 Cross-site scripting (XSS) vulnerability in Grav

MEDIUM Published 2024-02-09 Modified 2024-02-16 Official page ↗
Aliases
CVE-2023-31506
Ecosystem
Packagist
Packages
getgrav/grav
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-02-16

Affected packages

• Packagist getgrav/grav: < 1.7.44 (no fix yet)

Description

A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element.

Related

Alias · CVE (1)

  • CVE-2023-31506 A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References