~ / search / GHSA-qpgm-gjgf-8c2x

GHSA-qpgm-gjgf-8c2x

Craft CMS XSS in RSS widget feed

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-33195

Packages

EcosystemPackageAffectedFixed in
Packagist craftcms/cms >= 4.3.0, < 4.4.6 4.4.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary A malformed RSS feed can deliver an XSS payload ### PoC Create an RSS widget and add the domain https://blog.whitebear.vn/file/rss-xss2.rss The XSS payload will be triggered by the title in tag `<item>` Resolved in https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f

References

External links from the advisory. They lead to third-party sites.