What is GHSA-jfm4-3vv3-fm4v?

GHSA-jfm4-3vv3-fm4v is a security advisory published by GitHub Security Advisories with High severity. Cross-site Scripting (XSS) in CrafterCMS

Which CVE IDs does GHSA-jfm4-3vv3-fm4v cover?

GHSA-jfm4-3vv3-fm4v covers the following CVE IDs: CVE-2023-4136. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jfm4-3vv3-fm4v?

GHSA-jfm4-3vv3-fm4v has a CVSS v3 base score of 7.4, published by GitHub Security Advisories.

Which products are affected by GHSA-jfm4-3vv3-fm4v?

GHSA-jfm4-3vv3-fm4v affects 2 products, including: maven/org.craftercms:crafter-engine:\u003e= 4.0.0, \u003c 4.0.3; maven/org.craftercms:crafter-engine:\u003e= 3.1.0, \u003c 3.1.28.

GHSA-jfm4-3vv3-fm4vHighCVSS 7.4

Cross-site Scripting (XSS) in CrafterCMS

Vendor

GitHub Security Advisories

Published

August 3, 2023

Last Modified

February 13, 2025

🔗 CVE IDs covered (1)

CVE-2023-4136 →

📋 Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.

🎯 Affected products2

maven/org.craftercms:crafter-engine:>= 4.0.0, < 4.0.3
maven/org.craftercms:crafter-engine:>= 3.1.0, < 3.1.28

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-4136
https://docs.craftercms.org/en/4.0/security/advisory.html#cv-2023080301
http://seclists.org/fulldisclosure/2023/Aug/30
http://packetstormsecurity.com/files/174304/CrafterCMS-4.0.2-Cross-Site-Scripting.html
https://github.com/advisories/GHSA-jfm4-3vv3-fm4v