CVE-2023-4136

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine

MEDIUM 6.1EPSS 1.4%

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.

Affected: CrafterCMS
CVSS v3.1 NVD: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v3.1 CRAFTERSOFTWARE: 7.4 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
EPSS: 1.42% chance of exploitation in the next 30 days, 72nd percentile
Nuclei: medium · CWE-79
Published: 2023-08-03
Updated: 2025-02-13

Nuclei templates (1)

projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4136.yaml

Security advisories

https://docs.craftercms.org/en/4.0/security/advisory.html#cv-2023080301
advisories/GHSA-jfm4-3vv3-fm4v

References

CVE Record
NVD entry