CVE-2023-30177: Cross Site Scripting in CraftCMS

Q: What is the vulnerability ID of this CraftCMS vulnerability?

The vulnerability ID is CVE-2023-30177.

Q: What is the severity of CVE-2023-30177?

The severity of CVE-2023-30177 is medium.

Q: How does CVE-2023-30177 affect CraftCMS?

CVE-2023-30177 affects CraftCMS versions prior to 3.7.68.

Q: What is the impact of CVE-2023-30177?

The impact of CVE-2023-30177 is Cross-Site Scripting (XSS), allowing an attacker to inject JavaScript code into the Volume Name field.

Q: How can I fix CVE-2023-30177?

To fix CVE-2023-30177, upgrade CraftCMS to version 3.7.68 or later.

Published Apr 25, 2023

Updated

CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.

Other sources

CraftCMS prior to version 3.7.68 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.

Affected Software

3 affected componentsFixes available

composer/craftcms/cms<3.7.68

3.7.68

CraftCMS Craft CMS=3.7.59

composer/craftcms/cms<3.7.68

3.7.68

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/craftcms/cms to a version that resolves this vulnerability.
Fixed in 3.7.68
Upgrade
Upgrade CraftCMS to a version that resolves this vulnerability.
Fixed in 3.7.68

Event History

Apr 25, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Advisory Published

06:30 PM

Data Sourced

via Packagist·06:30 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the vulnerability ID of this CraftCMS vulnerability?

The vulnerability ID is CVE-2023-30177.

What is the severity of CVE-2023-30177?