What is GHSA-72pf-cvwq-vgqg?

GHSA-72pf-cvwq-vgqg is a security advisory published by GitHub Security Advisories with Medium severity. Craft CMS Cross-site Scripting (XSS) Vulnerability

Which CVE IDs does GHSA-72pf-cvwq-vgqg cover?

GHSA-72pf-cvwq-vgqg covers the following CVE IDs: CVE-2018-20418. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-72pf-cvwq-vgqg?

GHSA-72pf-cvwq-vgqg has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

Which products are affected by GHSA-72pf-cvwq-vgqg?

GHSA-72pf-cvwq-vgqg affects 1 product, including: composer/craftcms/cms:\u003c= 3.0.25.

GHSA-72pf-cvwq-vgqgMediumCVSS 4.8

Craft CMS Cross-site Scripting (XSS) Vulnerability

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

April 25, 2024

🔗 CVE IDs covered (1)

CVE-2018-20418 →

📋 Description

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.

🎯 Affected products1

composer/craftcms/cms:<= 3.0.25

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-20418
https://github.com/rdincel1/Craft-CMS-3.0.25---Cross-Site-Scripting
https://web.archive.org/web/20201208014852/https://www.raifberkaydincel.com/craft-cms-3-0-25-cross-site-scripting-vulnerability.html
https://www.exploit-db.com/exploits/46054
https://github.com/advisories/GHSA-72pf-cvwq-vgqg