PT-2023-27926 · Unknown · Crafter Cms

Egidio Romano · Published 2023-08-03 · Updated 2025-06-05 · CVE-2023-4136

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CrafterCMS versions 3.1.0 through 3.1.27 CrafterCMS versions 4.0.0 through 4.0.2

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This affects CrafterCMS on various operating systems, including Windows, MacOS, and Linux, and different architectures such as x86, ARM, and 64-bit.

Recommendations For versions 3.1.0 through 3.1.27, update to a version outside of this range to mitigate the risk. For versions 4.0.0 through 4.0.2, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting input validation to prevent malicious script injections until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-4136

GHSA-JFM4-3VV3-FM4V

Affected Products

Crafter Cms

References · 9

• https://osv.dev/vulnerability/CVE-2023-4136 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jfm4-3vv3-fm4v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4136 · Security Note
• https://github.com/craftercms/engine · Note
• https://twitter.com/pdnuclei_bot/status/1930550172355908056 · Twitter Post
• https://t.me/cibsecurity/67683 · Telegram Post
• https://docs.craftercms.org/en/4.0/security/advisory.html#cv-2023080301 · Note
• http://packetstormsecurity.com/files/174304/CrafterCMS-4.0.2-Cross-Site-Scripting.html · Note
• http://seclists.org/fulldisclosure/2023/Aug/30 · Note