CVE-2023-33495: Craft CMS HTML Injection Vulnerability
Summary
CVE-2023-33495: Craft CMS vulnerable to HTML injection. Affects craftcms/cms versions < 4.4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is a popular content management system used for building websites and web applications. It provides a range of features for managing content, templates, and assets. Craft CMS versions up to 4.4.9 are susceptible to an HTML Injection vulnerability.
Vulnerability Detail
The HTML Injection vulnerability in Craft CMS allows an attacker to inject malicious HTML code into user-generated content. This can lead to various security risks, including cross-site scripting (XSS) attacks, session hijacking, and defacement of web pages. The vulnerability is rated as moderate severity with a CVSS score of 6.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading immediately is not possible, a temporary workaround is to sanitize user-generated content to prevent the injection of malicious HTML. This can be achieved by using HTML sanitization libraries or functions that remove or escape potentially dangerous HTML tags and attributes.
Conclusion
Craft CMS versions up to 4.4.9 are vulnerable to HTML Injection, which can lead to various security risks. It is crucial to upgrade to version 4.4.10 or later to mitigate this vulnerability. Sanitizing user-generated content can provide temporary protection until the upgrade is performed. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for craftcms/cms →
FAQ
Craft CMS is a content management system designed for building websites and web applications. It offers a range of features for managing content, templates, and assets.
HTML Injection is a vulnerability that allows an attacker to inject malicious HTML code into user-generated content. This can lead to various security risks, including cross-site scripting (XSS) attacks and web page defacement.
The HTML Injection vulnerability in Craft CMS can enable attackers to perform cross-site scripting (XSS) attacks, hijack user sessions, and deface web pages. These risks can compromise the integrity and security of the affected website or application.
To mitigate this vulnerability, it is recommended to upgrade Craft CMS to version 4.4.10 or later. Additionally, sanitizing user-generated content can help prevent the injection of malicious HTML.
More information about upgrading Craft CMS can be found in the official upgrade guide provided by Craft CMS. The guide includes step-by-step instructions and considerations for a successful upgrade.
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
