CVE-2023-33194
Last modified
CVE-2023-33194 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. EPSS estimates a 0.62% chance of exploitation in the next 30 days.
Description
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Craftcms | Craft Cms | >= 3.0.0, < 3.8.6 |
| Craftcms | Craft Cms | >= 4.0.1, < 4.4.6 |
| Craftercms | Craftercms | 4.0.0 |
References
- https://github.com/craftcms/cms/releases/tag/4.4.6Release Notes
- https://github.com/craftcms/cms/releases/tag/4.4.6Release Notes
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-33194?
How severe is CVE-2023-33194?
How do I fix CVE-2023-33194?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-33189Pomerium is an identity and context-aware access proxy. With…9.8
- CVE-2023-3319Improper Neutralization of Input During Web Page Generation …5.4
- CVE-2023-33190Sealos is an open source cloud operating system distribution…9.8
- CVE-2023-33191Kyverno is a policy engine designed for Kubernetes. Kyverno …8.8
- CVE-2023-33192ntpd-rs is an NTP implementation written in Rust. ntpd-rs do…7.5
- CVE-2023-33193Emby Server is a user-installable home media server which st…9.1
- CVE-2023-33195Craft is a CMS for creating custom digital experiences on th…6.1
- CVE-2023-33196Craft is a CMS for creating custom digital experiences. Cros…5.4
- CVE-2023-33197Craft is a CMS for creating custom digital experiences on th…5.4
- CVE-2023-33198tgstation-server is a production scale tool for BYOND server…7.5
- CVE-2023-33199Rekor's goals are to provide an immutable tamper resistant l…5.3
- CVE-2023-3320The WP Sticky Social plugin for WordPress is vulnerable to …8.8
Are you affected by CVE-2023-33194?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST