Cross-Site Scripting (XSS)

2023-05-3010:03:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

craftcms

xss

library

sanitize

user inputs

front end

attacker

inject

execute

javascript

reviewsession

assetindexer.ts

EPSS

0.001

Percentile

40.0%

JSON

craftcms/cms is vulnerable to Cross-Site Scripting (XSS) attacks. The library does not properly sanitize user inputs before it outputs to the front end, allowing an attacker to inject and execute malicious javascript through the reviewSession function in AssetIndexer.ts.