CVE-2023-33197: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 26, 2023 (updated June 1, 2023)

Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.

References

github.com/advisories/GHSA-6qjx-787v-6pxr
github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766
github.com/craftcms/cms/releases/tag/4.4.6
github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxr
nvd.nist.gov/vuln/detail/CVE-2023-33197

Code Behaviors & Features

Detect and mitigate CVE-2023-33197 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →