CVE-2023-23927: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

March 3, 2023 (updated November 7, 2023)

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.

References

github.com/advisories/GHSA-qcrj-6ffc-v7hq
github.com/craftcms/cms/blob/develop/CHANGELOG.md
github.com/craftcms/cms/security/advisories/GHSA-qcrj-6ffc-v7hq
nvd.nist.gov/vuln/detail/CVE-2023-23927
user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4

Code Behaviors & Features

Detect and mitigate CVE-2023-23927 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →