What is GHSA-qcrj-6ffc-v7hq?

GHSA-qcrj-6ffc-v7hq is a security advisory published by GitHub Security Advisories with Medium severity. Craft CMS Stored Cross-site Scripting Injection Vulnerability

Which CVE IDs does GHSA-qcrj-6ffc-v7hq cover?

GHSA-qcrj-6ffc-v7hq covers the following CVE IDs: CVE-2023-23927. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qcrj-6ffc-v7hq?

GHSA-qcrj-6ffc-v7hq has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-qcrj-6ffc-v7hq?

GHSA-qcrj-6ffc-v7hq affects 2 products, including: composer/craftcms/cms:\u003e= 4.0.0-RC1, \u003c 4.3.7; composer/craftcms/cms:\u003e= 3.7.24, \u003c 3.7.64.

GHSA-qcrj-6ffc-v7hqMediumCVSS 6.1

Craft CMS Stored Cross-site Scripting Injection Vulnerability

Vendor

GitHub Security Advisories

Published

March 3, 2023

Last Modified

March 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-23927 →

📋 Description

Summary

When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the admin dashboard.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

Impact

Tested with the free version of Craft CMS 4.3.6.1

🎯 Affected products2

composer/craftcms/cms:>= 4.0.0-RC1, < 4.3.7
composer/craftcms/cms:>= 3.7.24, < 3.7.64

🔗 References (5)

https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03
https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4
https://nvd.nist.gov/vuln/detail/CVE-2023-23927
https://github.com/advisories/GHSA-qcrj-6ffc-v7hq