What is GHSA-wf98-vxv9-jqfv?

GHSA-wf98-vxv9-jqfv is a security advisory published by GitHub Security Advisories with Low severity. XSS Injection Vulnerability

Why does GHSA-wf98-vxv9-jqfv have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-wf98-vxv9-jqfv?

GHSA-wf98-vxv9-jqfv affects 1 product, including: composer/craftcms/cms:\u003c 3.7.29.

GHSA-wf98-vxv9-jqfvLowDisclosed before NVD

XSS Injection Vulnerability

Vendor

GitHub Security Advisories

Published

April 5, 2022

Last Modified

January 11, 2023

📋 Description

Impact

Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied.

Patches

This has been patched in Craft 3.7.29.

References

https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18

For more information

If you have any questions or comments about this advisory, email us at [email protected]

Credits: https://github.com/noobpk

🎯 Affected products1

composer/craftcms/cms:< 3.7.29

🔗 References (2)

https://github.com/craftcms/cms/security/advisories/GHSA-wf98-vxv9-jqfv
https://github.com/advisories/GHSA-wf98-vxv9-jqfv