{"id":"CVE-2023-31144","published":"2023-05-09T15:22:39Z","modified":"2025-01-28T16:40:41Z","title":"Craft CMS vulnerable to cross site scripting in RSS feed widget","vendor":"Craft CMS","product":"cms","tier":"tail","description":{"text":"Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00406,"percentile":0.34921,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442","tags":["x_refsource_MISC"]}],"priority":{"score":11.3,"factors":[{"name":"EPSS percentile","points":6.98},{"name":"CVSS severity","points":4.27}]},"vendorSlug":"craft-cms","affectedVersions":[{"vendor":"craftcms","product":"cms","versions":[">= 3.0.0, < 3.8.4",">= 4.0.0, < 4.4.4"]}],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=3.0.0, <3.8.4",">=4.0.0, <4.4.4"],"patched":["3.8.4","4.4.4"],"from":["GHSA-j4mx-98hw-6rv6"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1563","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2023-30177","published":"2023-04-25","fixed":"3.7.68","kev":false,"link":{"from":"CVE-2023-30177","to":"CVE-2023-31144","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"3.7.68","toFixed":"3.8.4","daysApart":14}]}},{"cve":"CVE-2022-37250","published":"2022-09-16","fixed":"4.2.1","kev":false},{"cve":"CVE-2022-37251","published":"2022-09-16","fixed":"4.2.1","kev":false},{"cve":"CVE-2023-23927","published":"2023-03-03","fixed":"4.3.7","kev":false,"link":{"from":"CVE-2023-23927","to":"CVE-2023-31144","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.3.7","toFixed":"4.4.4","daysApart":67}]}},{"cve":"CVE-2023-31144","published":"2023-05-09","fixed":"4.4.4","kev":false},{"cve":"CVE-2023-32679","published":"2023-05-19","fixed":"4.4.6","kev":false},{"cve":"CVE-2023-33194","published":"2023-05-26","fixed":"4.4.6","kev":false,"link":{"from":"CVE-2023-31144","to":"CVE-2023-33194","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"3.8.4","toFixed":"3.8.6","daysApart":17}]}},{"cve":"CVE-2023-33195","published":"2023-05-27","fixed":"4.4.6","kev":false}],"package":"Packagist:craftcms/cms"}}