Craft CMS Cross-site Scripting (XSS) Vulnerability
The advisory, in context
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 3.0.25 (inclusive)
No fix recorded for this interval.
438 explicitly affected versions
1.0.26.1, 1.2.0-alpha.2310, 1.2.0-alpha.2312, 1.2.0-alpha.2316, 1.2.0-alpha.2318, 1.2.0-alpha.2319, 1.2.0-alpha.2322, 1.2.0-alpha.2323, 1.2.0-alpha.2324, 1.2.0-alpha.2328, 1.2.0-alpha.2329, 1.2.0-alpha.2332, 1.2.2333, 1.2.2335, 1.2.2336, 1.2.2337, 1.2.2339, 1.2.2358, 1.2.2363, 1.2.2367, 1.2.2371, 1.2.2375, 1.2.2387, 1.2.2392, 1.2.2396, 1.2.2399, 1.3.0-alpha.2361, 1.3.0-alpha.2366, 1.3.0-alpha.2372, 1.3.0-alpha.2374, 1.3.0-alpha.2377, 1.3.0-alpha.2378, 1.3.0-alpha.2380, 1.3.0-alpha.2388, 1.3.0-alpha.2394, 1.3.0-alpha.2397, 1.3.0-alpha.2401, 1.3.0-alpha.2402, 1.3.0-alpha.2405, 1.3.0-alpha.2464, 1.3.2409, 1.3.2410, 1.3.2415, 1.3.2416, 1.3.2418, 1.3.2419, 1.3.2420, 1.3.2422, 1.3.2456, 1.3.2459, 1.3.2461, 1.3.2462, 1.3.2465, 1.3.2473, 1.3.2485, 1.3.2486, 1.3.2487, 1.3.2494, 1.3.2496, 1.3.2507, 1.4.0-alpha.2469, 1.4.0-alpha.2470, 1.4.0-alpha.2471, 1.4.0-alpha.2476, 1.4.0-alpha.2478, 1.4.0-alpha.2479, 1.4.0-alpha.2482, 1.4.0-alpha.2484, 1.4.0-alpha.2488, 1.4.0-alpha.2489, 1.4.0-alpha.2490, 1.4.0-alpha.2491, 1.4.0-alpha.2492, 1.4.0-alpha.2493, 1.4.0-alpha.2495, 1.4.0-alpha.2497, 1.4.0-alpha.2498, 1.4.0-alpha.2499, 1.4.0-alpha.2500, 1.4.0-alpha.2502, 1.4.0-alpha.2503, 1.4.0-alpha.2505, 1.4.0-alpha.2506, 1.4.0-alpha.2509, 1.4.0-alpha.2512, 1.4.0-alpha.2513, 1.4.0-alpha.2519, 1.4.0-alpha.2521, 2.0.2524, 2.0.2525, 2.0.2527, 2.0.2528, 2.0.2532, 2.0.2533, 2.0.2535, 2.0.2536, 2.0.2537, 2.0.2538, 2.0.2539, 2.0.2540, 2.0.2541, 2.0.2542, 2.0.2543, 2.0.2548, 2.0.2549, 2.0.2551, 2.1.0-alpha.2546, 2.1.0-alpha.2547, 2.1.0-alpha.2552, 2.1.2554, 2.1.2555, 2.1.2556, 2.1.2557, 2.1.2559, 2.1.2561, 2.1.2562, 2.1.2563, 2.1.2564, 2.1.2566, 2.1.2568, 2.1.2569, 2.1.2570, 2.2.0-alpha.2572, 2.2.0-alpha.2575, 2.2.0-alpha.2578, 2.2.2579, 2.2.2581, 2.2.2582, 2.2.2586, 2.2.2587, 2.2.2588, 2.2.2589, 2.2.2590, 2.2.2591, 2.2.2592, 2.2.2593, 2.2.2596, 2.2.2598, 2.2.2601, 2.2.2604, 2.2.2607, 2.3.0-alpha.2600, 2.3.0-alpha.2602, 2.3.0-alpha.2603, 2.3.0-alpha.2605, 2.3.0-alpha.2606, 2.3.0-alpha.2608, 2.3.0-alpha.2610, 2.3.0-alpha.2612, 2.3.0-alpha.2645, 2.3.2615, 2.3.2616, 2.3.2617, 2.3.2618, 2.3.2620, 2.3.2621, 2.3.2623, 2.3.2624, 2.3.2625, 2.3.2626, 2.3.2627, 2.3.2629, 2.3.2632, 2.3.2635, 2.3.2636, 2.3.2639, 2.3.2640, 2.3.2641, 2.3.2642, 2.3.2643, 2.3.2644, 2.4.2664, 2.4.2666, 2.4.2667, 2.4.2668, 2.4.2669, 2.4.2670, 2.4.2675, 2.4.2677, 2.4.2679, 2.4.2682, 2.4.2684, 2.4.2688, 2.4.2691, 2.4.2692, 2.4.2693, 2.4.2695, 2.4.2696, 2.4.2697, 2.4.2698, 2.4.2699, 2.4.2700, 2.4.2701, 2.4.2702, 2.4.2723, 2.4.2725, 2.4.2726, 2.5.0-beta.2713, 2.5.0-beta.2715, 2.5.0-beta.2716, 2.5.0-beta.2717, 2.5.0-beta.2720, 2.5.0-beta.2722, 2.5.0-beta.2724, 2.5.0-beta.2727, 2.5.0-beta.2740, 2.5.2750, 2.5.2752, 2.5.2753, 2.5.2754, 2.5.2755, 2.5.2757, 2.5.2759, 2.5.2760, 2.5.2761, 2.5.2762, 2.5.2763, 2.5.2765, 2.5.2767, 2.6.2771, 2.6.2773, 2.6.2774, 2.6.2776, 2.6.2778, 2.6.2779, 2.6.2780, 2.6.2781, 2.6.2783, 2.6.2784, 2.6.2785, 2.6.2788, 2.6.2789, 2.6.2791, 2.6.2793, 2.6.2794, 2.6.2795, 2.6.2796, 2.6.2797, 2.6.2798, 2.6.2804, 2.6.2903, 2.6.2911, 2.6.2916, 2.6.2922, 2.6.2923, 2.6.2929, 2.6.2930, 2.6.2931, 2.6.2940, 2.6.2944, 2.6.2945, 2.6.2949, 2.6.2950, 2.6.2951, 2.6.2952, 2.6.2953, 2.6.2954, 2.6.2955, 2.6.2956, 2.6.2957, 2.6.2958, 2.6.2959, 2.6.2960, 2.6.2961, 2.6.2962, 2.6.2963, 2.6.2964, 2.6.2965, 2.6.2966, 2.6.2967, 2.6.2968, 2.6.2969, 2.6.2970, 2.6.2971, 2.6.2972, 2.6.2973, 2.6.2974, 2.6.2975, 2.6.2976, 2.6.2977, 2.6.2978, 2.6.2979, 2.6.2980, 2.6.2981, 2.6.2982, 2.6.2983, 2.6.2984, 2.6.2985, 2.6.2986, 2.6.2987, 2.6.2988, 2.6.2989, 2.6.2990, 2.6.2991, 2.6.2992, 2.6.2993, 2.6.2994, 2.6.2995, 2.6.2996, 2.6.2997, 2.6.2998, 2.6.2999, 2.6.3000, 2.6.3001, 2.6.3002, 2.6.3003, 2.6.3004, 2.6.3005, 2.6.3006, 2.6.3007, 2.6.3008, 2.6.3009, 2.6.3010, 2.6.3011, 2.6.3012, 2.6.3013, 2.6.3014, 2.6.3015, 2.6.3016, 2.6.3017, 2.6.3018, 2.6.3019, 2.7.0, 2.7.0-beta.2, 2.7.0.1, 2.7.1, 2.7.10, 2.7.2, 2.7.3, 2.7.4, 2.7.5, 2.7.6, 2.7.7, 2.7.7.1, 2.7.7.2, 2.7.7.3, 2.7.8, 2.7.9, 2.8.0, 2.8.0.1, 2.8.0.2, 2.9.0, 2.9.1, 2.9.2, 3.0.0, 3.0.0-RC1, 3.0.0-RC10, 3.0.0-RC10.1, 3.0.0-RC11, 3.0.0-RC12, 3.0.0-RC13, 3.0.0-RC14, 3.0.0-RC15, 3.0.0-RC16, 3.0.0-RC16.1, 3.0.0-RC17, 3.0.0-RC17.1, 3.0.0-RC2, 3.0.0-RC3, 3.0.0-RC4, 3.0.0-RC5, 3.0.0-RC6, 3.0.0-RC7, 3.0.0-RC7.1, 3.0.0-RC8, 3.0.0-RC9, 3.0.0-beta.1, 3.0.0-beta.10, 3.0.0-beta.11, 3.0.0-beta.12, 3.0.0-beta.13, 3.0.0-beta.14, 3.0.0-beta.15, 3.0.0-beta.16, 3.0.0-beta.17, 3.0.0-beta.18, 3.0.0-beta.19, 3.0.0-beta.2, 3.0.0-beta.20, 3.0.0-beta.21, 3.0.0-beta.22, 3.0.0-beta.23, 3.0.0-beta.24, 3.0.0-beta.25, 3.0.0-beta.26, 3.0.0-beta.27, 3.0.0-beta.28, 3.0.0-beta.29, 3.0.0-beta.3, 3.0.0-beta.30, 3.0.0-beta.31, 3.0.0-beta.32, 3.0.0-beta.33, 3.0.0-beta.34, 3.0.0-beta.35, 3.0.0-beta.36, 3.0.0-beta.4, 3.0.0-beta.5, 3.0.0-beta.6, 3.0.0-beta.7, 3.0.0-beta.8, 3.0.0-beta.9, 3.0.0.1, 3.0.0.2, 3.0.1, 3.0.10, 3.0.10.1, 3.0.10.2, 3.0.10.3, 3.0.11, 3.0.12, 3.0.13, 3.0.13.1, 3.0.13.2, 3.0.14, 3.0.15, 3.0.16, 3.0.16.1, 3.0.17, 3.0.17.1, 3.0.18, 3.0.19, 3.0.2, 3.0.20, 3.0.21, 3.0.22, 3.0.23, 3.0.23.1, 3.0.24, 3.0.25, 3.0.3, 3.0.3.1, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.25"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.26.1",
"1.2.0-alpha.2310",
"1.2.0-alpha.2312",
"1.2.0-alpha.2316",
"1.2.0-alpha.2318",
"1.2.0-alpha.2319",
"1.2.0-alpha.2322",
"1.2.0-alpha.2323",
"1.2.0-alpha.2324",
"1.2.0-alpha.2328",
"1.2.0-alpha.2329",
"1.2.0-alpha.2332",
"1.2.2333",
"1.2.2335",
"1.2.2336",
"1.2.2337",
"1.2.2339",
"1.2.2358",
"1.2.2363",
"1.2.2367",
"1.2.2371",
"1.2.2375",
"1.2.2387",
"1.2.2392",
"1.2.2396",
"1.2.2399",
"1.3.0-alpha.2361",
"1.3.0-alpha.2366",
"1.3.0-alpha.2372",
"1.3.0-alpha.2374",
"1.3.0-alpha.2377",
"1.3.0-alpha.2378",
"1.3.0-alpha.2380",
"1.3.0-alpha.2388",
"1.3.0-alpha.2394",
"1.3.0-alpha.2397",
"1.3.0-alpha.2401",
"1.3.0-alpha.2402",
"1.3.0-alpha.2405",
"1.3.0-alpha.2464",
"1.3.2409",
"1.3.2410",
"1.3.2415",
"1.3.2416",
"1.3.2418",
"1.3.2419",
"1.3.2420",
"1.3.2422",
"1.3.2456",
"1.3.2459",
"1.3.2461",
"1.3.2462",
"1.3.2465",
"1.3.2473",
"1.3.2485",
"1.3.2486",
"1.3.2487",
"1.3.2494",
"1.3.2496",
"1.3.2507",
"1.4.0-alpha.2469",
"1.4.0-alpha.2470",
"1.4.0-alpha.2471",
"1.4.0-alpha.2476",
"1.4.0-alpha.2478",
"1.4.0-alpha.2479",
"1.4.0-alpha.2482",
"1.4.0-alpha.2484",
"1.4.0-alpha.2488",
"1.4.0-alpha.2489",
"1.4.0-alpha.2490",
"1.4.0-alpha.2491",
"1.4.0-alpha.2492",
"1.4.0-alpha.2493",
"1.4.0-alpha.2495",
"1.4.0-alpha.2497",
"1.4.0-alpha.2498",
"1.4.0-alpha.2499",
"1.4.0-alpha.2500",
"1.4.0-alpha.2502",
"1.4.0-alpha.2503",
"1.4.0-alpha.2505",
"1.4.0-alpha.2506",
"1.4.0-alpha.2509",
"1.4.0-alpha.2512",
"1.4.0-alpha.2513",
"1.4.0-alpha.2519",
"1.4.0-alpha.2521",
"2.0.2524",
"2.0.2525",
"2.0.2527",
"2.0.2528",
"2.0.2532",
"2.0.2533",
"2.0.2535",
"2.0.2536",
"2.0.2537",
"2.0.2538",
"2.0.2539",
"2.0.2540",
"2.0.2541",
"2.0.2542",
"2.0.2543",
"2.0.2548",
"2.0.2549",
"2.0.2551",
"2.1.0-alpha.2546",
"2.1.0-alpha.2547",
"2.1.0-alpha.2552",
"2.1.2554",
"2.1.2555",
"2.1.2556",
"2.1.2557",
"2.1.2559",
"2.1.2561",
"2.1.2562",
"2.1.2563",
"2.1.2564",
"2.1.2566",
"2.1.2568",
"2.1.2569",
"2.1.2570",
"2.2.0-alpha.2572",
"2.2.0-alpha.2575",
"2.2.0-alpha.2578",
"2.2.2579",
"2.2.2581",
"2.2.2582",
"2.2.2586",
"2.2.2587",
"2.2.2588",
"2.2.2589",
"2.2.2590",
"2.2.2591",
"2.2.2592",
"2.2.2593",
"2.2.2596",
"2.2.2598",
"2.2.2601",
"2.2.2604",
"2.2.2607",
"2.3.0-alpha.2600",
"2.3.0-alpha.2602",
"2.3.0-alpha.2603",
"2.3.0-alpha.2605",
"2.3.0-alpha.2606",
"2.3.0-alpha.2608",
"2.3.0-alpha.2610",
"2.3.0-alpha.2612",
"2.3.0-alpha.2645",
"2.3.2615",
"2.3.2616",
"2.3.2617",
"2.3.2618",
"2.3.2620",
"2.3.2621",
"2.3.2623",
"2.3.2624",
"2.3.2625",
"2.3.2626",
"2.3.2627",
"2.3.2629",
"2.3.2632",
"2.3.2635",
"2.3.2636",
"2.3.2639",
"2.3.2640",
"2.3.2641",
"2.3.2642",
"2.3.2643",
"2.3.2644",
"2.4.2664",
"2.4.2666",
"2.4.2667",
"2.4.2668",
"2.4.2669",
"2.4.2670",
"2.4.2675",
"2.4.2677",
"2.4.2679",
"2.4.2682",
"2.4.2684",
"2.4.2688",
"2.4.2691",
"2.4.2692",
"2.4.2693",
"2.4.2695",
"2.4.2696",
"2.4.2697",
"2.4.2698",
"2.4.2699",
"2.4.2700",
"2.4.2701",
"2.4.2702",
"2.4.2723",
"2.4.2725",
"2.4.2726",
"2.5.0-beta.2713",
"2.5.0-beta.2715",
"2.5.0-beta.2716",
"2.5.0-beta.2717",
"2.5.0-beta.2720",
"2.5.0-beta.2722",
"2.5.0-beta.2724",
"2.5.0-beta.2727",
"2.5.0-beta.2740",
"2.5.2750",
"2.5.2752",
"2.5.2753",
"2.5.2754",
"2.5.2755",
"2.5.2757",
"2.5.2759",
"2.5.2760",
"2.5.2761",
"2.5.2762",
"2.5.2763",
"2.5.2765",
"2.5.2767",
"2.6.2771",
"2.6.2773",
"2.6.2774",
"2.6.2776",
"2.6.2778",
"2.6.2779",
"2.6.2780",
"2.6.2781",
"2.6.2783",
"2.6.2784",
"2.6.2785",
"2.6.2788",
"2.6.2789",
"2.6.2791",
"2.6.2793",
"2.6.2794",
"2.6.2795",
"2.6.2796",
"2.6.2797",
"2.6.2798",
"2.6.2804",
"2.6.2903",
"2.6.2911",
"2.6.2916",
"2.6.2922",
"2.6.2923",
"2.6.2929",
"2.6.2930",
"2.6.2931",
"2.6.2940",
"2.6.2944",
"2.6.2945",
"2.6.2949",
"2.6.2950",
"2.6.2951",
"2.6.2952",
"2.6.2953",
"2.6.2954",
"2.6.2955",
"2.6.2956",
"2.6.2957",
"2.6.2958",
"2.6.2959",
"2.6.2960",
"2.6.2961",
"2.6.2962",
"2.6.2963",
"2.6.2964",
"2.6.2965",
"2.6.2966",
"2.6.2967",
"2.6.2968",
"2.6.2969",
"2.6.2970",
"2.6.2971",
"2.6.2972",
"2.6.2973",
"2.6.2974",
"2.6.2975",
"2.6.2976",
"2.6.2977",
"2.6.2978",
"2.6.2979",
"2.6.2980",
"2.6.2981",
"2.6.2982",
"2.6.2983",
"2.6.2984",
"2.6.2985",
"2.6.2986",
"2.6.2987",
"2.6.2988",
"2.6.2989",
"2.6.2990",
"2.6.2991",
"2.6.2992",
"2.6.2993",
"2.6.2994",
"2.6.2995",
"2.6.2996",
"2.6.2997",
"2.6.2998",
"2.6.2999",
"2.6.3000",
"2.6.3001",
"2.6.3002",
"2.6.3003",
"2.6.3004",
"2.6.3005",
"2.6.3006",
"2.6.3007",
"2.6.3008",
"2.6.3009",
"2.6.3010",
"2.6.3011",
"2.6.3012",
"2.6.3013",
"2.6.3014",
"2.6.3015",
"2.6.3016",
"2.6.3017",
"2.6.3018",
"2.6.3019",
"2.7.0",
"2.7.0-beta.2",
"2.7.0.1",
"2.7.1",
"2.7.10",
"2.7.2",
"2.7.3",
"2.7.4",
"2.7.5",
"2.7.6",
"2.7.7",
"2.7.7.1",
"2.7.7.2",
"2.7.7.3",
"2.7.8",
"2.7.9",
"2.8.0",
"2.8.0.1",
"2.8.0.2",
"2.9.0",
"2.9.1",
"2.9.2",
"3.0.0",
"3.0.0-RC1",
"3.0.0-RC10",
"3.0.0-RC10.1",
"3.0.0-RC11",
"3.0.0-RC12",
"3.0.0-RC13",
"3.0.0-RC14",
"3.0.0-RC15",
"3.0.0-RC16",
"3.0.0-RC16.1",
"3.0.0-RC17",
"3.0.0-RC17.1",
"3.0.0-RC2",
"3.0.0-RC3",
"3.0.0-RC4",
"3.0.0-RC5",
"3.0.0-RC6",
"3.0.0-RC7",
"3.0.0-RC7.1",
"3.0.0-RC8",
"3.0.0-RC9",
"3.0.0-beta.1",
"3.0.0-beta.10",
"3.0.0-beta.11",
"3.0.0-beta.12",
"3.0.0-beta.13",
"3.0.0-beta.14",
"3.0.0-beta.15",
"3.0.0-beta.16",
"3.0.0-beta.17",
"3.0.0-beta.18",
"3.0.0-beta.19",
"3.0.0-beta.2",
"3.0.0-beta.20",
"3.0.0-beta.21",
"3.0.0-beta.22",
"3.0.0-beta.23",
"3.0.0-beta.24",
"3.0.0-beta.25",
"3.0.0-beta.26",
"3.0.0-beta.27",
"3.0.0-beta.28",
"3.0.0-beta.29",
"3.0.0-beta.3",
"3.0.0-beta.30",
"3.0.0-beta.31",
"3.0.0-beta.32",
"3.0.0-beta.33",
"3.0.0-beta.34",
"3.0.0-beta.35",
"3.0.0-beta.36",
"3.0.0-beta.4",
"3.0.0-beta.5",
"3.0.0-beta.6",
"3.0.0-beta.7",
"3.0.0-beta.8",
"3.0.0-beta.9",
"3.0.0.1",
"3.0.0.2",
"3.0.1",
"3.0.10",
"3.0.10.1",
"3.0.10.2",
"3.0.10.3",
"3.0.11",
"3.0.12",
"3.0.13",
"3.0.13.1",
"3.0.13.2",
"3.0.14",
"3.0.15",
"3.0.16",
"3.0.16.1",
"3.0.17",
"3.0.17.1",
"3.0.18",
"3.0.19",
"3.0.2",
"3.0.20",
"3.0.21",
"3.0.22",
"3.0.23",
"3.0.23.1",
"3.0.24",
"3.0.25",
"3.0.3",
"3.0.3.1",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2018-20418
- https://github.com/craftcms/cms
- https://github.com/rdincel1/Craft-CMS-3.0.25---Cross-Site-Scripting
- https://web.archive.org/web/20201208014852/https://www.raifberkaydincel.com/craft-cms-3-0-25-cross-site-scripting-vulnerability.html
- https://www.exploit-db.com/exploits/46054