CVE-2023-2817: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 26, 2023 (updated November 7, 2023)

A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.

References

github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb
nvd.nist.gov/vuln/detail/CVE-2023-2817
www.tenable.com/security/research/tra-2023-20,

Code Behaviors & Features

Detect and mitigate CVE-2023-2817 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →