{"id":"CVE-2023-33196","published":"2023-05-26T20:22:23Z","modified":"2025-01-14T19:29:53Z","title":"Craft CMS stored XSS in review volume","vendor":"Craft CMS","product":"cms","tier":"tail","description":{"text":"Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.\n\n","provenance":"source","from":"CVE.org"},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00653,"percentile":0.5115,"provenance":"source"},"cwes":[{"id":"CWE-80","name":"Improper Neutralization of Script-Related HTML Tags in a Web Page"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-cjmm-x9x9-m2w5","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7","tags":["x_refsource_MISC"]},{"url":"https://github.com/craftcms/cms/releases/tag/4.4.7","tags":["x_refsource_MISC"]}],"priority":{"score":14.1,"factors":[{"name":"EPSS percentile","points":10.23},{"name":"CVSS severity","points":3.85}]},"vendorSlug":"craft-cms","affectedVersions":[{"vendor":"craftcms","product":"cms","versions":[">= 4.0.0-RC1, <= 4.4.6"]}],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=4.0.0-RC1, <4.4.7"],"patched":["4.4.7"],"from":["GHSA-cjmm-x9x9-m2w5"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1526","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2023-33194","published":"2023-05-26","fixed":"4.4.6","kev":false},{"cve":"CVE-2023-33195","published":"2023-05-27","fixed":"4.4.6","kev":false},{"cve":"CVE-2023-33197","published":"2023-05-26","fixed":"4.4.6","kev":false},{"cve":"CVE-2023-33196","published":"2023-05-26","fixed":"4.4.7","kev":false},{"cve":"CVE-2023-2817","published":"2023-05-26","fixed":"4.4.12","kev":false,"link":{"from":"CVE-2023-33196","to":"CVE-2023-2817","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.4.7","toFixed":"4.4.12","daysApart":0}]}},{"cve":"CVE-2023-40035","published":"2023-08-23","fixed":"4.4.15","kev":false},{"cve":"CVE-2023-41892","published":"2023-09-13","fixed":"4.4.15","kev":false}],"package":"Packagist:craftcms/cms"}}