Description

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.

Remediation

References

CVE-2023-33194

Related Vulnerabilities

WordPress Plugin Enable Media Replace SQL Injection and Arbitrary File Upload Vulnerabilities (2.3)

MySQL Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2010-1848)

PHP Other Vulnerability (CVE-2015-6834)

MySQL CVE-2022-21633 Vulnerability (CVE-2022-21633)

WordPress Plugin WP Construction Mode Cross-Site Request Forgery (3.31)

Severity

Medium

Classification

CVE-2023-33194 CWE-707 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities