CVE-2023-23927

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.

Published: Mar 3, 2023
Updated: May 9, 2024
CVE: CVE-2023-23927
GHSA: GHSA-qcrj-6ffc-v7hq
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.4
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
craftcms / craft_cms	-	4.3.7
craftcms / cms	4.0.0-RC1	4.3.7
craftcms / cms	3.7.24	3.7.64

https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03
https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq
https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4

Vulnerability Database

CVE-2023-23927

Deep Security Visibility Without the Complexity