CVE-2023-33495: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

June 20, 2023 (updated November 7, 2023)

Craft CMS through 4.4.9 is vulnerable to HTML Injection.

References

medium.com/@mondalsomnath9135/html-injection-in-craft-cms-application-e2b28f746212
nvd.nist.gov/vuln/detail/CVE-2023-33495
owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/03-Testing_for_HTML_Injection

Code Behaviors & Features

Detect and mitigate CVE-2023-33495 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →