PT-2023-22566 · Craft Cms · Craft Cms

Angrybrad · Published 2023-04-25 · Updated 2023-05-04 · CVE-2023-30177

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CraftCMS versions 3.7.59 through 3.7.67

Description The issue allows an attacker to inject javascript code into the Volume Name, potentially leading to Cross Site Scripting (XSS) attacks. This could enable attackers to execute malicious scripts on the affected system.

Recommendations For CraftCMS versions 3.7.59 through 3.7.67, update to version 3.7.68 or later to resolve the issue. As a temporary workaround, consider restricting access to the Volume Name field to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-30177

GHSA-WV7J-RC2Q-9J67

Affected Products

Craft Cms

References · 6

• https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e · Patch
• https://osv.dev/vulnerability/GHSA-wv7j-rc2q-9j67 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30177 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30177 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://t.me/cibsecurity/62824 · Telegram Post