CVE-2023-33196

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-33196
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-33196.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-33196
Aliases
Published
2023-05-26T20:22:23Z
Modified
2026-10-21T02:30:20Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Craft CMS stored XSS in review volume
Details

Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-80"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33196.json"
}
References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
d4f2f5f311eb3829300f0aaccb193ffcca03eaef
Fixed
08687f7f76c75a346616729ef4adf9e8f07ccdf7
Introduced
982efcd14d7e93a1a54f0905b61f242de6b53d8a
Fixed
053d7119697e480ff81c5723bb9a33eaa49e0fc7
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.1"
                },
                {
                    "fixed":  "4.4.7"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0-NA"
                },
                {
                    "last_affected":  "4.0.0-NA"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0-rc1"
                },
                {
                    "last_affected":  "4.0.0-rc1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0-rc2"
                },
                {
                    "last_affected":  "4.0.0-rc2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0-rc3"
                },
                {
                    "last_affected":  "4.0.0-rc3"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "053d7119697e480ff81c5723bb9a33eaa49e0fc7"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "4.4.7",
            "range":  [
                {
                    "fixed":  "08687f7f76c75a346616729ef4adf9e8f07ccdf7"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}
Type
GIT
Repo
https://github.com/nystudio107/craft-seomatic
Events
Introduced
a31f7d211b52d55d274c66a291310ceec64c733f
Last Affected
a31f7d211b52d55d274c66a291310ceec64c733f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0-NA"
                },
                {
                    "last_affected":  "4.0.0-NA"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

4.*
4.0.0
4.0.0-NA
4.0.0-rc1
4.0.0-rc2
4.0.0-rc3
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.5.1
4.0.5.2
4.0.6
4.1.0
4.1.0.1
4.1.0.2
4.1.1
4.1.2
4.1.3
4.1.4
4.1.4.1
4.2.0
4.2.0.1
4.2.0.2
4.2.1
4.2.1.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.5.1
4.2.5.2
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.2
4.3.2.1
4.3.3
4.3.4
4.3.5
4.3.6
4.3.6.1
4.3.7
4.3.7.1
4.3.8
4.3.8.1
4.3.8.2
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-33196.json"