CVE-2020-19626: Craft CMS Cross-site Scripting Vulnerability
Summary
CVE-2020-19626: Craft CMS Cross-site Scripting Vulnerability. Affects craftcms/cms versions < 3.1.33. Fixed in 3.1.33. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is a popular content management system used for building websites and web applications. It provides a flexible and customizable platform for managing content and creating dynamic web pages. Craft CMS version 3.1.31 is affected by a Cross-site Scripting (XSS) vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This vulnerability can be exploited through the '/admin/settings/sites/new' endpoint.
Vulnerability Detail
The Cross-site Scripting (XSS) vulnerability in Craft CMS version 3.1.31 allows attackers to inject malicious web script or HTML code into the affected application. This can lead to various security risks, such as stealing sensitive user information, performing unauthorized actions on behalf of the user, or defacing the website. The vulnerability originates from improper input sanitization and validation in the affected endpoint, which allows the execution of arbitrary code in the context of the user's browser.
How To Fix
Minimum fixed version
3.1.33
This is the first release that contains the fix.
composer require craftcms/cms:3.1.33Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling or securing the '/admin/settings/sites/new' endpoint. This can be achieved by restricting access to the endpoint or implementing additional input validation and sanitization measures to prevent the execution of malicious code.
Conclusion
The Craft CMS XSS vulnerability in version 3.1.31 can be mitigated by upgrading to version 3.1.33 or later. It is important to promptly apply the necessary updates to ensure the security and integrity of the application. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for craftcms/cms →
FAQ
Craft CMS is a content management system used for building websites and web applications. It provides a flexible and customizable platform for managing content and creating dynamic web pages.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts or HTML code into web pages viewed by other users. This can lead to various security risks, such as stealing sensitive information or performing unauthorized actions on behalf of the user.
The Craft CMS XSS vulnerability allows remote attackers to inject arbitrary web script or HTML code into the application. This can lead to various security risks, such as stealing user information, performing unauthorized actions, or defacing the website.
To fix the Craft CMS XSS vulnerability, it is recommended to upgrade to version 3.1.33 or later. This version includes a fix for the vulnerability and ensures proper input sanitization and validation.
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by securing or disabling the '/admin/settings/sites/new' endpoint. This can help mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
