CVE-2023-36260: High severity craft cms vulnerability
An issue discovered in Craft CMS version 4.6.1.1 allows remote attackers to cause a denial of service (DoS) via crafted string to Feed-Me Name and Feed-Me URL fields due to saving a feed using an Asset element type with no volume selected.
Other sources
An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security."
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-36260?
CVE-2023-36260 has been identified as a denial-of-service vulnerability that can significantly disrupt the availability of services.
How do I fix CVE-2023-36260?
To mitigate CVE-2023-36260, upgrade Craft CMS to version 4.6.2 or later.
Which versions of Craft CMS are affected by CVE-2023-36260?
CVE-2023-36260 affects Craft CMS versions up to and including 4.6.1.1.
What components are involved in CVE-2023-36260?
CVE-2023-36260 involves the Feed Me plugin and Asset element type within Craft CMS.
Can CVE-2023-36260 be exploited remotely?
Yes, CVE-2023-36260 can be exploited by remote attackers through crafted strings targeting specific fields.