craftcms/cms · Security
Craft CMS Stored Cross-site Scripting Injection Vulnerability
- GHSA ID
- GHSA-qcrj-6ffc-v7hq
- CVE ID
- CVE-2023-23927
- Severity
- medium
- Published
- Updated
- CVSS
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
Summary
When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the admin dashboard.
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability.
Impact
Tested with the free version of Craft CMS 4.3.6.1
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq ↗
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03 ↗
- https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-23927 ↗
- https://github.com/advisories/GHSA-qcrj-6ffc-v7hq ↗