CVE-2023-4136: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine
First published: Thu Aug 03 2023(Updated: )
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.
Credit: security@craftersoftware.com security@craftersoftware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Craftercms Craftercms | >=3.1.0<=3.1.27 | |
| Craftercms Craftercms | >=4.0.0<=4.0.2 | |
| Apple macOS | ||
| Apple macOS | ||
| Apple macOS | ||
| Linux Linux kernel | ||
| Linux Linux kernel | ||
| Linux Linux kernel | ||
| Microsoft Windows | ||
| Microsoft Windows | ||
| Microsoft Windows | ||
| All of | ||
| Any of | ||
| Craftercms Craftercms | >=3.1.0<=3.1.27 | |
| Craftercms Craftercms | >=4.0.0<=4.0.2 | |
| Any of | ||
| Apple macOS | ||
| Apple macOS | ||
| Apple macOS | ||
| Linux Linux kernel | ||
| Linux Linux kernel | ||
| Linux Linux kernel | ||
| Microsoft Windows | ||
| Microsoft Windows | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-4136.
What is the severity rating of CVE-2023-4136?
CVE-2023-4136 has a severity rating of 6.1, which is considered high.
What is the affected software for CVE-2023-4136?
The affected software for CVE-2023-4136 is CrafterCMS version 4.0.0 through 4.0.2 and version 3.1.0 through 3.1.27.
What is the CWE ID for CVE-2023-4136?
The CWE ID for CVE-2023-4136 is CWE-79.
How can I fix the CVE-2023-4136 vulnerability?
To fix the CVE-2023-4136 vulnerability, it is recommended to update CrafterCMS to a version that is not affected by the vulnerability.
- collector/nvd-latest
- collector/nvd-index
- agent/author
- agent/type
- agent/severity
- agent/title
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/craftercms
- canonical/craftercms craftercms
- version/craftercms craftercms/3.1.0
- version/craftercms craftercms/3.1.27
- version/craftercms craftercms/4.0.0
- version/craftercms craftercms/4.0.2
- vendor/apple
- canonical/apple macos
- vendor/linux
- canonical/linux linux kernel
- vendor/microsoft
- canonical/microsoft windows