CVE-2023-33195: Craft CMS XSS in RSS widget feed
Summary A malformed RSS feed can deliver an XSS payload
PoC Create an RSS widget and add the domain https://blog.whitebear.vn/file/rss-xss2.rss The XSS payload will be triggered by the title in tag <item>
Resolved in https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f
Other sources
Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/craftcms/cmsto a version that resolves this vulnerability.Fixed in 4.4.6 - Upgrade
Upgrade
craftcms/cmsto a version that resolves this vulnerability.Fixed in 4.4.6Patch b77cb3023bed4f4a37c11294c4d319ff9f598e1f
Event History
Frequently Asked Questions
What is CVE-2023-33195?
CVE-2023-33195 is a vulnerability in Craft CMS that allows a malformed RSS feed to deliver an XSS payload.
How can a malformed RSS feed deliver an XSS payload in Craft CMS?
A malformed RSS feed can deliver an XSS payload in Craft CMS by triggering the XSS payload in the title tag of the <item> element.
What is the severity of CVE-2023-33195?
The severity of CVE-2023-33195 is medium with a CVSS score of 6.1.
How do I fix CVE-2023-33195 in Craft CMS?
To fix CVE-2023-33195 in Craft CMS, update to version 4.4.6 or later.
What is the CWE number for CVE-2023-33195?
The CWE number for CVE-2023-33195 is CWE-79, which is the category for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').