Craft CMS Cross-site Scripting (XSS) Vulnerability in craftcms/cms
Summary
CVE-2018-20418: Craft CMS Cross-site Scripting (XSS) Vulnerability. Affects craftcms/cms versions < 3.0.25. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is a popular content management system used for building websites and web applications. It provides a flexible and user-friendly interface for managing content and has a wide range of features and plugins. The craftcms/cms package is the core package of Craft CMS, responsible for the basic functionality of the system. Unfortunately, this package is vulnerable to a Cross-site Scripting (XSS) vulnerability.
Vulnerability Detail
The vulnerability, identified as GHSA-72pf-cvwq-vgqg, exists in the index.php?p=admin/actions/entries/save-entry endpoint of Craft CMS version 3.0.25. It allows an attacker to execute arbitrary JavaScript code by saving a new title from the console tab. This can lead to various security issues, including the theft of sensitive user information, session hijacking, and defacement of the website. The vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality or restrict access to the vulnerable endpoint. However, this may impact the normal operation of the CMS and is not a long-term solution. It is strongly advised to apply the official patch or upgrade to a secure version of Craft CMS.
Conclusion
Craft CMS version 3.0.25 is vulnerable to a Cross-site Scripting (XSS) vulnerability in the index.php?p=admin/actions/entries/save-entry endpoint. Users are advised to upgrade to a secure version of Craft CMS beyond 3.0.25 or apply the official patch provided by the Craft CMS development team. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for craftcms/cms →
FAQ
Craft CMS is a content management system used for building websites and web applications. It provides a flexible and user-friendly interface for managing content.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various security issues, such as data theft, session hijacking, and website defacement.
The vulnerability in Craft CMS allows an attacker to execute arbitrary JavaScript code by saving a new title from the console tab. This can be exploited to perform various malicious actions on the affected website.
The vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to a version of Craft CMS that includes the patch for this issue. The Craft CMS development team has released a fix in a later version.
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
