Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
118 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Craft CMS 3.70-RC1–3.7.55.1 and 4.0.0-RC1–4.2.0.1 are vulnerable to Cross Site Scripting (XSS) via entry revisions and drafts. Versions 3.7.55.2 and 4.2.1 contain patches for this issue.
Recommended action: Upgrade to 4.2.1 or 3.7.55.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.
Recommended action: Upgrade to 4.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
Recommended action: Upgrade to 3.1.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
Recommended action: Upgrade to 3.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.
Recommended action: Upgrade to 3.3.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS.
Recommended action: Upgrade to 3.1.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Recommended action: Upgrade to 2.6.2974 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
Recommended action: Upgrade to 2.6.2976 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.
Recommended action: Upgrade to 2.6.2976 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
Recommended action: Upgrade to 2.6.2982 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.
Recommended action: Upgrade to 2.6.2976 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).
Recommended action: Upgrade to 3.7.36 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied. Patches This has been patched in Craft 3.7.29. References https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18 For more information If you have any questions or comments about this advisory, email us at support@craftcms.com ---------- Credits: https://github.com/noobpk
Recommended action: Upgrade to 3.7.29 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS before 3.7.29 allows cross-site scripting.
Recommended action: Upgrade to 3.7.29 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Recommended action: Upgrade to 3.6.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In some circumstances, it was possible to export data in CSV format that could trigger a payload in old versions of Excel. If you are accepting user input from untrusted sources and will be exporting that data in CSV format from element index pages and there is a chance users will open that on old versions of Excel, then you should update. Patches This has been patched in Craft 3.7.14. References https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28 https://twitter.com/craftcmsupdates/status/1442928690145366018 For more information If you have any questions or comments about this advisory, email us at support@craftcms.com ---------- Credits: BAE Systems AI Vulnerability Research Team – Azrul Ikhwan Zulkifli
Recommended action: Upgrade to 3.7.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).
Recommended action: Upgrade to 3.6.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
Recommended action: Upgrade to 3.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.