PT-2023-23177 · Craft Cms · Craft Cms

Dominikrebecki · Published 2023-05-05 · Updated 2023-05-16 · CVE-2023-31144

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 3.0.0 through 3.8.3 Craft CMS versions 3.8.4 is not affected for version 3, but versions prior to 4.4.4 are affected for version 4, so Craft CMS versions 4.0.0 through 4.4.3

Description A malformed title in the feed widget can deliver a cross-site scripting payload. This issue has been resolved in specific commits.

Recommendations For Craft CMS versions 3.0.0 through 3.8.3, update to version 3.8.4 to resolve the issue. For Craft CMS versions 4.0.0 through 4.4.3, update to version 4.4.4 to resolve the issue. As a temporary workaround, consider disabling the feed widget until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-31144

GHSA-J4MX-98HW-6RV6

Affected Products

Craft Cms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31144.json · Exploit
• https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31144 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31144 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j4mx-98hw-6rv6 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/commit/e2f7e7b7d86a0afa54ce855375d13c7760670764 · Note
• https://t.me/cvenotify/50038 · Telegram Post