{"id":"CVE-2023-2817","published":"2023-05-26T00:00:00Z","modified":"2025-01-15T15:48:32Z","title":"A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11","vendor":null,"product":null,"tier":"tail","description":{"text":"A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00444,"percentile":0.3865,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.tenable.com/security/research/tra-2023-20%2C","tags":[]},{"url":"https://github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb","tags":[]}],"priority":{"score":11.5,"factors":[{"name":"EPSS percentile","points":7.73},{"name":"CVSS severity","points":3.78}]},"affectedVersions":[{"vendor":"n/a","product":"Craft CMS","versions":["versions prior or equal to version 4.4.11"]}],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=4.0.0-RC1, <4.4.12"],"patched":["4.4.12"],"from":["GHSA-7x94-jx75-3gh6"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1496","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-craft-cms-cms-cve-2022-37246","parents":[{"from":"CVE-2022-37246","to":"CVE-2023-2817","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/web/assets/cp/dist/cp.js","src/web/assets/cp/dist/cp.js.map"],"commits":["https://github.com/craftcms/cms/commit/1d5fdba23c84d6d09a8a980c7b6fc52fb93b679b","https://github.com/craftcms/cms/commit/ecefe7f0afe0a6c4d1097a570cba82753d33f681","https://github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-33195","published":"2023-05-27","fixed":"4.4.6","kev":false},{"cve":"CVE-2023-33197","published":"2023-05-26","fixed":"4.4.6","kev":false},{"cve":"CVE-2023-33196","published":"2023-05-26","fixed":"4.4.7","kev":false,"link":{"from":"CVE-2023-33196","to":"CVE-2023-2817","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.4.7","toFixed":"4.4.12","daysApart":0}]}},{"cve":"CVE-2023-2817","published":"2023-05-26","fixed":"4.4.12","kev":false},{"cve":"CVE-2023-40035","published":"2023-08-23","fixed":"4.4.15","kev":false,"link":{"from":"CVE-2023-2817","to":"CVE-2023-40035","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.4.12","toFixed":"4.4.15","daysApart":89}]}},{"cve":"CVE-2023-41892","published":"2023-09-13","fixed":"4.4.15","kev":false,"link":{"from":"CVE-2023-2817","to":"CVE-2023-41892","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.4.12","toFixed":"4.4.15","daysApart":110}]}},{"cve":"CVE-2024-21622","published":"2024-01-03","fixed":"4.5.11","kev":false}],"package":"Packagist:craftcms/cms"}}