GHSA-qpgm-gjgf-8c2x

Source

https://github.com/advisories/GHSA-qpgm-gjgf-8c2x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-qpgm-gjgf-8c2x/GHSA-qpgm-gjgf-8c2x.json

Aliases

• CVE-2023-33195

Published

2023-05-26T13:55:00Z

Modified

2024-02-16T08:10:53.670846Z

Details

Summary

A malformed RSS feed can deliver an XSS payload

PoC

Create an RSS widget and add the domain https://blog.whitebear.vn/file/rss-xss2.rss The XSS payload will be triggered by the title in tag <item>

Resolved in https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f

References

• https://github.com/craftcms/cms/security/advisories/GHSA-qpgm-gjgf-8c2x
• https://nvd.nist.gov/vuln/detail/CVE-2023-33195
• https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f
• https://github.com/craftcms/cms
• https://github.com/craftcms/cms/releases/tag/4.4.6