GHSA-7x94-jx75-3gh6MediumCVSS 5.4

Stored cross site scripting in Craft CMS

Published
May 26, 2023
Last Modified
November 12, 2023

🔗 CVE IDs covered (1)

CVE-2023-2817 →

📋 Description

A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively. This issue was patched in version 4.4.12.

🎯 Affected products1

  • composer/craftcms/cms:>= 4.0.0-RC1, < 4.4.12

🔗 References (4)