GHSA-v89q-c273-3p42

Craft CMS Audit Plugin Cross Site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-36259

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	superbig/craft-audit	< 3.0.2	3.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-36259 advisory
https://github.com/sjelfull/craft-audit/pull/73 web
https://github.com/sjelfull/craft-audit/commit/c2888aa48457f24696ac0a2ba4f54f39e5c672ed web
https://github.com/sjelfull/craft-audit package
https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D web