PT-2023-22566 · Craft Cms · Craft Cms

Angrybrad · Publicado 2023-04-25 · Atualizado 2023-05-04 · CVE-2023-30177

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CraftCMS versions 3.7.59 through 3.7.67

Description The issue allows an attacker to inject javascript code into the Volume Name, potentially leading to Cross Site Scripting (XSS) attacks. This could enable attackers to execute malicious scripts on the affected system.

Recommendations For CraftCMS versions 3.7.59 through 3.7.67, update to version 3.7.68 or later to resolve the issue. As a temporary workaround, consider restricting access to the Volume Name field to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-30177

GHSA-WV7J-RC2Q-9J67

Produtos afetados

Craft Cms

Referências · 6

• https://github.com/craftcms/cms · Nota
• https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-30177 · Nota de Segurança
• https://t.me/cibsecurity/62824 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-30177 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wv7j-rc2q-9j67 · Aviso do Fabricante