PT-2023-24214 · Craft · Craft

Whitebearvn · Published 2023-05-26 · Updated 2023-06-01 · CVE-2023-33197

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Craft versions prior to 4.4.6

Description Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue allows an attacker to inject malicious scripts, potentially leading to unauthorized access or data theft. The vulnerability is exploited by injecting a payload into the asset name, which is then triggered when the Update Asset Indexes utility is used. The JSON response from the volumes name can also trigger the payload on every POST request in the utility.

Recommendations For versions prior to 4.4.6, update to version 4.4.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the Update Asset Index utility until the update can be applied. Avoid using the utility with untrusted input to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2023-33197

GHSA-6QJX-787V-6PXR

Affected Products

Craft

References · 10

• 🔥 https://github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33197.json · Exploit
• https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766 · Patch
• https://osv.dev/vulnerability/CVE-2023-33197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33197 · Security Note
• https://osv.dev/vulnerability/GHSA-6qjx-787v-6pxr · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/4.4.6 · Note
• https://t.me/cibsecurity/64731 · Telegram Post
• https://t.me/cvenotify/51228 · Telegram Post