PT-2023-24213 · Craft · Craft

Whitebearvn · Publicado 2023-05-26 · Atualizado 2023-06-02 · CVE-2023-33196

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Craft versions prior to 4.4.7

Description Cross-site scripting (XSS) can be triggered by review volumes. The issue is related to the index.php?p=admin/actions/asset-indexes/process-indexing-session function, where the skippedEntries and missingEntries parameters are not properly filtered. This allows an attacker to inject malicious scripts, such as <script>alert(1337)</script>, into the assets name, which can be triggered when clicking the review button.

Recommendations For versions prior to 4.4.7, update to version 4.4.7 to resolve the issue. As a temporary workaround, consider restricting access to the index.php?p=admin/actions/asset-indexes/process-indexing-session endpoint until the update is applied. Additionally, avoid using the skippedEntries and missingEntries parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-80

CWE-79

Identificadores relacionados

CVE-2023-33196

GHSA-CJMM-X9X9-M2W5

Produtos afetados

Craft

Referências · 8

• 🔥 https://github.com/craftcms/cms/security/advisories/GHSA-cjmm-x9x9-m2w5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33196.json · Exploit
• https://github.com/craftcms/cms · Nota
• https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7 · Correção
• https://github.com/craftcms/cms/releases/tag/4.4.7 · Nota
• https://osv.dev/vulnerability/GHSA-cjmm-x9x9-m2w5 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33196 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-33196 · Aviso do Fabricante