CVE-2023-23927
Craft CMS stored cross-site scripting vulnerability
Summary
Craft CMS stored cross-site scripting vulnerability
Original description
The description as published by the source.
Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Packagist
craftcms/cms
[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.24"},{"fixed":"3.7.64"}]}]
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web github.com
- web user-images.githubusercontent.com