GHSA-33jj-92px-m4g7

ghsaUSosv

Craft CMS Cross-site Scripting Vulnerability

view advisory published 2022-05-24Licence: CC-BY-4.0

Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via `/admin/settings/sites/new`.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-19626US	medium5.4	0.85% (58th)	—	2021-03-26
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.

references

External citations — patches, advisories, analysis.

https://github.com/craftcms/cms/commit/76a2168b6a5e30144f5c06da4ff264f4eca577ffWEB
https://nvd.nist.gov/vuln/detail/CVE-2020-19626ADVISORY
https://web.archive.org/web/20211209121705/http://mayoterry.com/file/cve/XSS_vuluerability_in_Craftcms_3.1.31.pdfWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan