PT-2023-27926 · Unknown · Crafter Cms

Egidio Romano · Publicado 2023-08-03 · Atualizado 2025-06-05 · CVE-2023-4136

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CrafterCMS versions 3.1.0 through 3.1.27 CrafterCMS versions 4.0.0 through 4.0.2

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This affects CrafterCMS on various operating systems, including Windows, MacOS, and Linux, and different architectures such as x86, ARM, and 64-bit.

Recommendations For versions 3.1.0 through 3.1.27, update to a version outside of this range to mitigate the risk. For versions 4.0.0 through 4.0.2, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting input validation to prevent malicious script injections until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-4136

GHSA-JFM4-3VV3-FM4V

Produtos afetados

Crafter Cms

Referências · 9

• https://github.com/craftercms/engine · Nota
• https://osv.dev/vulnerability/CVE-2023-4136 · Aviso do Fabricante
• https://twitter.com/pdnuclei_bot/status/1930550172355908056 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-jfm4-3vv3-fm4v · Aviso do Fabricante
• https://t.me/cibsecurity/67683 · Publicação no Telegram
• https://docs.craftercms.org/en/4.0/security/advisory.html#cv-2023080301 · Nota
• http://packetstormsecurity.com/files/174304/CrafterCMS-4.0.2-Cross-Site-Scripting.html · Nota
• http://seclists.org/fulldisclosure/2023/Aug/30 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-4136 · Nota de Segurança