CVE-2023-33196 Craft CMS stored XSS in review volume

2023-05-2620:22:23

CWE-80

GitHub_M

www.cve.org

craft cms

stored xss

review volumes

version 4.4.7

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

EPSS

0.001

Percentile

40.0%

JSON

Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.

CNA Affected

[
  {
    "vendor": "craftcms",
    "product": "cms",
    "versions": [
      {
        "version": ">= 4.0.0-RC1, <= 4.4.6",
        "status": "affected"
      }
    ]
  }
]