Description (CNA)
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of any higher-privileged user viewing the affected element, allowing account creation and other authenticated actions.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| craftcms / cms | affected 5.0.0-RC1 before 5.10.8; unaffected 5.10.8 |
CWE
CWE-79
References
- https://github.com/craftcms/cms/security/advisories/GHSA-2rp4-x2j7-qmcc
- https://www.vulncheck.com/advisories/craft-cms-rc1-before-stored-xss-via-draft-name
ADP enrichment
No English description supplied.
No references supplied.