CraftCMS prior to version 3.7.68 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.

**Cross Site Scripting in CraftCMS**

Moderate severity GitHub Reviewed Published Apr 25, 2023 to the GitHub Advisory Database • Updated Apr 26, 2023

GHSA-wv7j-rc2q-9j67: Cross Site Scripting in CraftCMS

CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.

Skip to content

Sign up

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    
    Explore
    
    *   All features
    *   Documentation
    *   GitHub Skills
    *   Blog
    
*   For
    
    *   Enterprise
    *   Teams
    *   Startups
    *   Education
    
    By Solution
    
    *   CI/CD & Automation
    *   DevOps
    *   DevSecOps
    
    Case Studies
    
    *   Customer Stories
    *   Resources
    
*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
    Repositories
    
    *   Topics
    *   Trending
    *   Collections
    
*   Pricing

*   In this repository All GitHub
    

*   No suggested jump to results

*   In this repository All GitHub
    
*   In this organization All GitHub
    
*   In this repository All GitHub
    

Sign in

Sign up

craftcms / **cms** Public

*   Notifications
*   Fork 611
*   Star 3k
    

*   Code
*   Issues 349
*   Pull requests 49
*   Discussions
*   Actions
*   Security
*   Insights

More

Permalink

Browse files

Fixed an XSS vulnerability.

*   Loading branch information

angrybrad committed

Feb 23, 2023

1 parent dea6a42 commit 00fb253

Show file tree

Hide file tree

Showing **2 changed files** with **2 additions** and **1 deletion**.

*   CHANGELOG.md
*   *   Asset.php

1 CHANGELOG.md

Show comments View file

  

@@ -3,6 +3,7 @@

\## Unreleased

\- Fixed a bug where \`craft\\events\\RegisterElementSourcesEvent::$context\` wasn’t always set to \`modal\` when defining the available element sources for an element selection modal.

\- Fixed a styling bug where multi-line checkbox labels within the Customize Sources modal weren’t wrapping properly. (\[#12717\](https://github.com/craftcms/cms/issues/12717))

\- Fixed an XSS vulnerability.

  

\## 3.7.67 - 2023-02-17

  

2 src/elements/Asset.php

Show comments View file

@@ -1856,7 +1856,7 @@ protected function metadata(): array

  

return \[

Craft::t('app', 'Location') => function() use ($volume) {

$loc = \[Craft::t('site', $volume\->name)\];

$loc = \[Html::encode(Craft::t('site', $volume\->name))\];

if ($this\->folderPath) {

array\_push($loc, ...ArrayHelper::filterEmptyStringsFromArray(explode('/', $this\->folderPath)));

}

**0 comments on commit 00fb253**

Please sign in to comment.

CVE-2023-30177: Fixed an XSS vulnerability. · craftcms/cms@00fb253

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Oliver Schlöbe Simple Yearly Archive plugin <= 2.1.8 versions.

**Solution**

Update the WordPress Simple Yearly Archive plugin to the latest available version (at least 2.1.9).

Found this useful? Thank Rio Darmawan for reporting this vulnerability. Buy a coffee ☕

Rio Darmawan discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Simple Yearly Archive Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.1.9.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-25484: WordPress Simple Yearly Archive plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.

**Solution**

Update the WordPress Quick Contact Form plugin to the latest available version (at least 8.0.4).

Found this useful? Thank yuyudhn for reporting this vulnerability. Buy a coffee ☕

yuyudhn discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Quick Contact Form Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 8.0.4.

**6 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-47608: WordPress Quick Contact Form plugin <= 8.0.3.1 - Cross Site Scripting (XSS) - Patchstack

Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user.

Permalink

Browse files

Thanks Jefferson Gonzales

this update prevents the XSS attack

Description:

While making an account in demo.avideo.com I found a parameter "?success=" which did not sanitize any symbol character properly which leads to XSS attack.

Impact:

Since there's an Admin account on demo.avideo.com attacker can use this attack to Takeover the admin's account

Step to Reproduce:

1. Click the link below

https://demo.avideo.com/user?success="><img src=x onerror=alert(document.cookie)>

2. Then XSS will be executed

*   Loading branch information

CVE-2023-25314: Thanks Jefferson Gonzales · WWBN/AVideo@2b44dee

WordPress Shield Security Smart Bot Blocking and Intrusion Prevention plugin versions 17.0.17 and below suffer from cross site scripting and missing authorization vulnerabilities.

    Affected Plugin: Shield Security – Smart Bot Blocking & Intrusion Prevention Plugin Slug: wp-simple-firewallAffected Versions: <= 17.0.17CVE ID: CVE-2023-0992 CVSS Score: 7.2 (High)CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Researcher/s: Ramuel Gall Fully Patched Version: 17.0.18The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Description: Shield Security <= 17.0.17 - Missing Authorization Affected Plugin: Shield Security – Smart Bot Blocking & Intrusion Prevention Plugin Slug: wp-simple-firewallAffected Versions: <= 17.0.17CVE ID: CVE-2023-0993 CVSS Score: 4.3 (Medium)CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Researcher/s: Ramuel Gall Fully Patched Version: 17.0.18The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17. This allows authenticated attackers to add arbitrary audit log entries indicating that a theme or plugin has been edited, and is also a vector for Cross-Site Scripting via CVE-2023-0992.Vulnerability AnalysisThe Shield Security plugin includes a number of features, including an audit log that records certain types of suspicious activity, such as plugin and theme installation, modification, post deletion, and other types of activity that might impact the site. While most of these events require authentication or higher privileges in order to trigger, we found that certain events could be triggered by unauthenticated users. In particular, failed attempts to authenticate using application passwords, new user registrations, and spam activity are among the actions recorded for unauthenticated users.The audit log records metadata about the client that performed the logged activity, including the client’s User-Agent, which can be accessed by clicking the “Meta” tag icon on an audit log entry. Unfortunately, the metadata was not escaped when it was output. While most of the metadata collected about a request has a very strict format and can only be spoofed to a limited extent, User-Agent strings are alphanumeric, and we were able to inject a script in an iframe in the User-Agent header that fired when an administrator viewed an event entry:shieldalert-1024x454 While this exploit does technically require user interaction, it can be considered “Passive” user interaction, that is, it does not require tricking the administrator into performing any actions they might not have performed otherwise. Depending on the payload used, an attacker could use the script executing in the administrator’s browser to create a new administrator account under their control. Additionally, this exploit can be automated, and can be exploited by unauthenticated attackers via a variety of vectors, at least one of which is likely to be present in most common site configurations. As such it earns its High severity rating.The second vulnerability was much lower in severity and consisted of a missing authorization check on the ‘edit-theme-plugin-file’ AJAX action, which is used to record edits to plugin or theme files. The primary consequence of this is that an authenticated attacker can spoof an audit log entry indicating that any file belonging to any plugin or theme on the site was edited. While this is primarily a nuisance, since it can be used to create audit log entries it is yet another vector to exploit the aforementioned Cross-Site Scripting vulnerability.Disclosure TimelineMarch 20, 2023 – Wordfence Premium, Care, and Response users receive a firewall rule to provide protection against any exploits that may target this vulnerability. We responsibly disclose the plugin to the developer, who responds quickly and releases a patch in version 17.0.18.April 19, 2023 – The firewall rule becomes available to all Wordfence users.ConclusionIn today’s post, we detailed a High Severity Cross-Site Scripting vulnerability in Shield Security. We also detailed a lower-severity issue allowing authenticated attackers to spoof audit log entries indicating that plugin and theme files had been edited. These vulnerabilities have been fully patched in version 17.0.18.Wordfence Premium, Care, and Response users received a firewall rule to protect against any exploits targeting this vulnerability on March 20, 2023. Sites still using the free version of Wordfence received the same protection on April 19, 2023.If you know a friend or colleague who is using the Shield Security plugin on their site, we highly recommend forwarding this advisory to them as the Cross-Site Scripting vulnerability can allow Unauthenticated attackers to execute malicious JavaScript in an administrator’s browser, which can lead to site takeover.If you are a security researcher, you can responsibly disclose your finds to us and obtain a CVE ID and get your name on the Wordfence Intelligence leaderboard. Thanks to Paul Goodchild from Shield Security for patching the issue quickly.

WordPress Shield Security 17.0.17 Cross Site Scripting / Missing Authorization

Red Hat Security Advisory 2023-1980-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: kernel-rt security and bug fix update  
Advisory ID:       RHSA-2023:1980-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:1980  
Issue date:        2023-04-25  
CVE Names:         CVE-2023-0386  
====================================================================  
1. Summary:

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.0  
Extended Update Support.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Real Time EUS (v.9.0) - x86_64  
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0) - x86_64

3. Description:

The kernel-rt packages provide the Real Time Linux Kernel, which enables  
fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: FUSE filesystem low-privileged user privileges escalation  
(CVE-2023-0386)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

Bug Fix(es):

* kernel-rt: update RT source tree to the latest RHEL-9.0.z8 Batch  
(BZ#2182175)

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2159505 - CVE-2023-0386 kernel: FUSE filesystem low-privileged user privileges escalation

6. Package List:

Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0):

Source:  
kernel-rt-5.14.0-70.53.1.rt21.124.el9_0.src.rpm

x86_64:  
kernel-rt-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-core-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-core-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-debuginfo-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-devel-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-kvm-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-modules-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-modules-extra-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debuginfo-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debuginfo-common-x86_64-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-devel-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-kvm-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-modules-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-modules-extra-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm

Red Hat Enterprise Linux Real Time EUS (v.9.0):

Source:  
kernel-rt-5.14.0-70.53.1.rt21.124.el9_0.src.rpm

x86_64:  
kernel-rt-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-core-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-core-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-debuginfo-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-devel-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-modules-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debug-modules-extra-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debuginfo-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-debuginfo-common-x86_64-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-devel-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-modules-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm  
kernel-rt-modules-extra-5.14.0-70.53.1.rt21.124.el9_0.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-0386  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZEe/MdzjgjWX9erEAQhhpg//fGcucGqgFdE3jllEcS9paAgaZ2B+OCdO  
d/+rlhabtnc48n0M2JEwfKm87EleC2rPgewrsDvDowaerJWzQF9SDDkJL6fiNBEO  
5eGPLL9Xzjwv6H2WPPeZWj+fzNYCIRkrHXROCyAQC4MRD1VRrlM4XdJ1RycHxVdG  
QpyD3AWFXSX+Un73qRXHG8VwTd8PQiSf1XM/0FK4J3Ym+KM9rQxtT6SRhS0NFLvl  
IK9hdsPrx7j2p6UUG/c+hg7gedqCRpQoJ6KIKho2+05G7d6SmrFtwTIVcBGouOFp  
Ef0HFSIhHn0It70oLx77AlVc96dkNP9luuA140FkoQMTrY4k8JpVnNYT84HMrWyr  
U2MBYER+kWq/2x1RKseM1H39MQdkPWnjGVU+XSbGen6z2TsrN17zavBsrk6sGk/4  
ZcLlyEpOlOnzXjeC8v1jsgJwdlg3f9CUNWqK7Q6fcgw8EOI499StThoV/0Q9TdG7  
jd2im+QpugUnMEAI7V+fgfA6Yfvm4S5p+WBxKo5ujLv/GQvcymW2ocfZrcPP8qtr  
cOq0NlBthTFjXp6+u+PsUlagZE7wXsSu6ISM1b/qwsZB/JjXKeRTJyHKSG/d431z  
cxE5DgErN2nsEb0NS7pL04gk7N1U9LVnQEIj+WTQF0gTrYVGawOlgR8eqFVSKlgb  
skYVo8EvyXA=USzD  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-1980-01

A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title of a private message.

**漏洞类型**  
存储式跨站脚本

**受影响实体版本号**  
pear-admin-boot <= 2.0.2

**漏洞验证**  
前置条件：具有私信权限的用户登录  
步骤：  
1.运行pear-admin-boot = 2.0.2环境  
2.管理员新建一个具有私信权限的用户  
3.具有私信权限的用户登录  
4.发送一条私信给“管理”用户，标题带有payload:123<script>alert(1)</script>456  
完整请求报文：  
POST /system/notice/save HTTP/1.1  
Accept: application/json, text/javascript, _/_; q=0.01  
Accept-Encoding: gzip, deflate, br  
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,en-US;q=0.7,en;q=0.6  
Connection: keep-alive  
Content-Length: 141  
Content-Type: application/json  
Cookie: rememberme-token=M1lPJTJCTFpzMDdWQjcxVXFtRXVUQWNRJTNEJTNEOkFWRUNDbDlqWFVTOFIlMkZCVjFrN2xCdyUzRCUzRA; JSESSIONID=E032828B9FC2AA972BBAABEE11EC4456  
Host: 127.0.0.1:8080  
Origin: http://127.0.0.1:8080  
Referer: http://127.0.0.1:8080/system/notice/add  
Sec-Fetch-Dest: empty  
Sec-Fetch-Mode: cors  
Sec-Fetch-Site: same-origin  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36  
X-Requested-With: XMLHttpRequest  
sec-ch-ua: "Google Chrome";v="111", "Not(A:Brand";v="8", "Chromium";v="111"  
sec-ch-ua-mobile: ?0  
sec-ch-ua-platform: "Windows"

{"title":"123<script>alert(1)</script>456","content":"123456","sender":"1642713637653180417","accept":"1309861917694623744","type":"private"}  
5.使用管理员账号登录，登录时会触发XSS

**修复建议**  
我提交了一个Pull Request，在SysNoticeServiceImpl.java的selectSysNoticeList方法中向页面输出响应前，对title和content进行了html实体编码，应该能解决这个漏洞

CVE-2023-30417: pear-admin-boot存在存储式跨站脚本漏洞 · Issue #I6SXHX · Pear Admin/Pear Admin Boot - Gitee.com

Reflected Cross-Site Scripting (XSS) vulnerability in Denis ???????? plugin <= 6.0.1 versions.

**Solution**

Deactivate and delete. No reply from the vendor.

Found this useful? Thank minhtuanact for reporting this vulnerability. Buy a coffee ☕

minhtuanact discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress 微信机器人高级版 Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-45837: WordPress 微信机器人高级版 plugin <= 6.0.1 - Reflected Cross-Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin <= 1.4.0 versions.

**Solution**

Update the WordPress Click to Call or Chat Buttons plugin to the latest available version (at least 1.5.0).

Found this useful? Thank yuyudhn for reporting this vulnerability. Buy a coffee ☕

yuyudhn discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Click to Call or Chat Buttons Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.5.0.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

Tag

#xss