PoC Index

CVE-2023-33194

MEDIUM 4.8EPSS 0.6%

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.

CVSS v3.1
4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v3.1
3.7 LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
CVSS v3.1
3.7 LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
EPSS
0.62% chance of exploitation in the next 30 days, 47th percentile
Published
2023-05-26
Updated
2025-01-14

Proof-of-concept exploits (1)

References

Related