PT-2023-24213 · Craft · Craft

Whitebearvn · Published 2023-05-26 · Updated 2023-06-02 · CVE-2023-33196

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Craft versions prior to 4.4.7

Description Cross-site scripting (XSS) can be triggered by review volumes. The issue is related to the index.php?p=admin/actions/asset-indexes/process-indexing-session function, where the skippedEntries and missingEntries parameters are not properly filtered. This allows an attacker to inject malicious scripts, such as <script>alert(1337)</script>, into the assets name, which can be triggered when clicking the review button.

Recommendations For versions prior to 4.4.7, update to version 4.4.7 to resolve the issue. As a temporary workaround, consider restricting access to the index.php?p=admin/actions/asset-indexes/process-indexing-session endpoint until the update is applied. Additionally, avoid using the skippedEntries and missingEntries parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2023-33196

GHSA-CJMM-X9X9-M2W5

Affected Products

Craft

References · 8

• 🔥 https://github.com/craftcms/cms/security/advisories/GHSA-cjmm-x9x9-m2w5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33196.json · Exploit
• https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-33196 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33196 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cjmm-x9x9-m2w5 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/4.4.7 · Note