CVE-2023-31144

Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.

Published: May 9, 2023
Updated: May 9, 2024
CVE: CVE-2023-31144
GHSA: GHSA-j4mx-98hw-6rv6
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.1
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
craftcms / cms	3.0.0	3.8.4
craftcms / cms	4.0.0	4.4.4
craftcms / craft_cms	4.0.0	4.4.3.x
craftcms / craft_cms	3.0.0	3.8.3.x

https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442
https://github.com/craftcms/cms/commit/e2f7e7b7d86a0afa54ce855375d13c7760670764
https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6

Vulnerability Database

CVE-2023-31144

Deep Security Visibility Without the Complexity