GHSA-qpgm-gjgf-8c2xMediumCVSS 6.1

Craft CMS XSS in RSS widget feed

Published
May 26, 2023
Last Modified
November 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-33195 →

📋 Description

Summary

A malformed RSS feed can deliver an XSS payload

PoC

Create an RSS widget and add the domain https://blog.whitebear.vn/file/rss-xss2.rss The XSS payload will be triggered by the title in tag <item>

Resolved in https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f

🎯 Affected products1

  • composer/craftcms/cms:>= 4.3.0, <= 4.4.5

🔗 References (5)