CVE-2022-37246: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

September 21, 2022 (updated September 22, 2022)

Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.

References

github.com/craftcms/cms/commit/1d5fdba23c84d6d09a8a980c7b6fc52fb93b679b
labs.integrity.pt/advisories/cve-2022-37246/
nvd.nist.gov/vuln/detail/CVE-2022-37246

Code Behaviors & Features

Detect and mitigate CVE-2022-37246 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →