Fluid Attacks Database

Description

craftcms/cms vulnerable to cross site scripting in RSS feed widget A malformed title in the feed widget of craftcms/cms can deliver an XSS payload. This has been resolved in this commit.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
packagist	craftcms/cms	>=3.0.0 <3.8.4 \|\| >=4.0.0 <4.4.4	3.8.4, 4.4.4

Aliases

1. CVE-2023-311442. NVD-2023-311443. OSV-2023-311444. GHSA-j4mx-98hw-6rv65. GCVE-2023-31144

References

1. https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv62. https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca25284423. https://github.com/craftcms/cms/commit/e2f7e7b7d86a0afa54ce855375d13c7760670764

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.