GHSA-qcrj-6ffc-v7hq
Craft CMS Stored Cross-site Scripting Injection Vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | craftcms/cms | >= 4.0.0-RC1, < 4.3.7 | 4.3.7 |
| Packagist | craftcms/cms | >= 3.7.24, < 3.7.64 | 3.7.64 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
_When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the
admin dashboard._
### PoC
[_Complete instructions, including specific configuration details, to reproduce the vulnerability._](https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4)
### Impact
Tested with the free version of Craft CMS 4.3.6.1
References
External links from the advisory. They lead to third-party sites.
- https://github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq
- https://nvd.nist.gov/vuln/detail/CVE-2023-23927
- https://github.com/craftcms/cms
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#437---2023-02-03
- https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4