PT-2023-23177 · Craft Cms · Craft Cms

Dominikrebecki · Publicado 2023-05-05 · Atualizado 2023-05-16 · CVE-2023-31144

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 3.0.0 through 3.8.3 Craft CMS versions 3.8.4 is not affected for version 3, but versions prior to 4.4.4 are affected for version 4, so Craft CMS versions 4.0.0 through 4.4.3

Description A malformed title in the feed widget can deliver a cross-site scripting payload. This issue has been resolved in specific commits.

Recommendations For Craft CMS versions 3.0.0 through 3.8.3, update to version 3.8.4 to resolve the issue. For Craft CMS versions 4.0.0 through 4.4.3, update to version 4.4.4 to resolve the issue. As a temporary workaround, consider disabling the feed widget until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-31144

GHSA-J4MX-98HW-6RV6

Produtos afetados

Craft Cms

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31144.json · Exploit
• https://github.com/craftcms/cms · Nota
• https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442 · Correção
• https://github.com/craftcms/cms/commit/e2f7e7b7d86a0afa54ce855375d13c7760670764 · Nota
• https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6 · Aviso do Fabricante
• https://t.me/cvenotify/50038 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-31144 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-31144 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-j4mx-98hw-6rv6 · Aviso do Fabricante