GHSA-33jj-92px-m4g7

Craft CMS Cross-site Scripting Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-19626

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	craftcms/cms	< 3.1.33	3.1.33

Details

As written in the advisory (Markdown source, shown as plain text).

Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via `/admin/settings/sites/new`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-19626 advisory
https://github.com/craftcms/cms/commit/76a2168b6a5e30144f5c06da4ff264f4eca577ff web
https://web.archive.org/web/20211209121705/http://mayoterry.com/file/cve/XSS_vuluerability_in_Craftcms_3.1.31.pdf web