CVE-2022-37783: Infoleak
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. The CRAFTCSRFTOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-37783?
CVE-2022-37783 is a vulnerability in Craft CMS versions between 3.0.0 and 3.7.32 that discloses password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens.
What is the severity of CVE-2022-37783?
The severity of CVE-2022-37783 is high, with a CVSS score of 7.5.
How do I fix CVE-2022-37783?
To fix CVE-2022-37783, you should upgrade Craft CMS to version 3.7.33 or higher.
What is Anti-CSRF-Tokens in Craft CMS?
Anti-CSRF-Tokens in Craft CMS are used to prevent Cross-Site Request Forgery (CSRF) attacks by using a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN.
Where can I find more information about CVE-2022-37783?
You can find more information about CVE-2022-37783 on the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-37783), [TÜV Trust IT](https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes/), [CVES](https://cves.at/posts/cve-2022-37783/writeup/)