craftcms/cms vulnerable to cross site scripting in RSS feed widget
The advisory, in context
A malformed title in the feed widget of craftcms/cms can deliver an XSS payload. This has been resolved in this commit.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 3.0.0 before 3.8.4
Fixed in 3.8.4
408 explicitly affected versions
3.0.0, 3.0.0.1, 3.0.0.2, 3.0.1, 3.0.10, 3.0.10.1, 3.0.10.2, 3.0.10.3, 3.0.11, 3.0.12, 3.0.13, 3.0.13.1, 3.0.13.2, 3.0.14, 3.0.15, 3.0.16, 3.0.16.1, 3.0.17, 3.0.17.1, 3.0.18, 3.0.19, 3.0.2, 3.0.20, 3.0.21, 3.0.22, 3.0.23, 3.0.23.1, 3.0.24, 3.0.25, 3.0.26, 3.0.26.1, 3.0.27, 3.0.27.1, 3.0.28, 3.0.29, 3.0.3, 3.0.3.1, 3.0.30, 3.0.30.1, 3.0.30.2, 3.0.31, 3.0.32, 3.0.33, 3.0.34, 3.0.35, 3.0.36, 3.0.37, 3.0.38, 3.0.39, 3.0.4, 3.0.40, 3.0.40.1, 3.0.41, 3.0.41.1, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.0-beta.1, 3.1.0-beta.2, 3.1.0-beta.3, 3.1.0-beta.4, 3.1.0-beta.5, 3.1.0-beta.5.1, 3.1.0-beta.6, 3.1.0-beta.7, 3.1.1, 3.1.10, 3.1.11, 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.17.1, 3.1.17.2, 3.1.18, 3.1.19, 3.1.2, 3.1.2.1, 3.1.2.2, 3.1.20, 3.1.20.1, 3.1.21, 3.1.21.1, 3.1.22, 3.1.23, 3.1.24, 3.1.25, 3.1.26, 3.1.27, 3.1.28, 3.1.29, 3.1.3, 3.1.30, 3.1.31, 3.1.32, 3.1.32.1, 3.1.33, 3.1.34, 3.1.34.1, 3.1.34.2, 3.1.34.3, 3.1.4, 3.1.5, 3.1.6, 3.1.6.1, 3.1.7, 3.1.8, 3.1.9, 3.1.9.1, 3.2.0, 3.2.0-RC1, 3.2.0-RC2, 3.2.0-RC3, 3.2.0-alpha.1, 3.2.0-alpha.2, 3.2.0-alpha.2.1, 3.2.0-alpha.3, 3.2.0-alpha.4, 3.2.0-alpha.5, 3.2.0-alpha.6, 3.2.0-alpha.6.1, 3.2.0-alpha.6.2, 3.2.0-alpha.6.3, 3.2.0-alpha.6.4, 3.2.0-alpha.7, 3.2.0-beta.1, 3.2.0-beta.2, 3.2.0-beta.3, 3.2.1, 3.2.10, 3.2.2, 3.2.3, 3.2.4, 3.2.4.1, 3.2.5, 3.2.5.1, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 3.3.0, 3.3.0.1, 3.3.1, 3.3.1.1, 3.3.1.2, 3.3.10, 3.3.11, 3.3.12, 3.3.13, 3.3.14, 3.3.15, 3.3.16, 3.3.16.1, 3.3.16.2, 3.3.16.3, 3.3.17, 3.3.18, 3.3.18.1, 3.3.18.2, 3.3.18.3, 3.3.18.4, 3.3.19, 3.3.2, 3.3.20, 3.3.20.1, 3.3.3, 3.3.4, 3.3.4.1, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.4.0, 3.4.0-RC1, 3.4.0-RC1.1, 3.4.0-RC2, 3.4.0-RC3, 3.4.0-beta.1, 3.4.0-beta.2, 3.4.0-beta.3, 3.4.0-beta.4, 3.4.0-beta.5, 3.4.0.1, 3.4.0.2, 3.4.1, 3.4.10, 3.4.10.1, 3.4.11, 3.4.12, 3.4.13, 3.4.14, 3.4.15, 3.4.16, 3.4.17, 3.4.17.1, 3.4.18, 3.4.19, 3.4.19.1, 3.4.2, 3.4.20, 3.4.21, 3.4.22, 3.4.22.1, 3.4.23, 3.4.24, 3.4.25, 3.4.26, 3.4.27, 3.4.28, 3.4.28.1, 3.4.29, 3.4.29.1, 3.4.3, 3.4.30, 3.4.4, 3.4.4.1, 3.4.5, 3.4.6, 3.4.6.1, 3.4.7, 3.4.7.1, 3.4.8, 3.4.9, 3.5.0, 3.5.0-RC1, 3.5.0-RC1.1, 3.5.0-RC2, 3.5.0-RC3, 3.5.0-RC4, 3.5.0-RC5, 3.5.0-RC6, 3.5.0-beta.1, 3.5.0-beta.2, 3.5.0-beta.3, 3.5.1, 3.5.10, 3.5.10.1, 3.5.11, 3.5.11.1, 3.5.12, 3.5.12.1, 3.5.13, 3.5.13.1, 3.5.13.2, 3.5.14, 3.5.15, 3.5.15.1, 3.5.16, 3.5.17, 3.5.17.1, 3.5.18, 3.5.19, 3.5.19.1, 3.5.2, 3.5.3, 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.5.9, 3.6.0, 3.6.0-RC1, 3.6.0-RC2, 3.6.0-RC2.1, 3.6.0-RC3, 3.6.0-RC4, 3.6.0-beta.1, 3.6.0-beta.1.1, 3.6.0-beta.2, 3.6.0.1, 3.6.1, 3.6.10, 3.6.11, 3.6.11.1, 3.6.11.2, 3.6.12, 3.6.12.1, 3.6.13, 3.6.14, 3.6.15, 3.6.16, 3.6.17, 3.6.18, 3.6.2, 3.6.3, 3.6.4, 3.6.4.1, 3.6.5, 3.6.5.1, 3.6.6, 3.6.7, 3.6.8, 3.6.9, 3.7.0, 3.7.0-beta.1, 3.7.0-beta.2, 3.7.0-beta.3, 3.7.0-beta.4, 3.7.0-beta.5, 3.7.0-beta.6, 3.7.1, 3.7.10, 3.7.11, 3.7.12, 3.7.13, 3.7.14, 3.7.15, 3.7.16, 3.7.17, 3.7.17.1, 3.7.17.2, 3.7.18, 3.7.18.1, 3.7.18.2, 3.7.19, 3.7.19.1, 3.7.2, 3.7.20, 3.7.21, 3.7.22, 3.7.23, 3.7.24, 3.7.25, 3.7.25.1, 3.7.26, 3.7.27, 3.7.27.1, 3.7.27.2, 3.7.28, 3.7.29, 3.7.3, 3.7.3.1, 3.7.3.2, 3.7.30, 3.7.30.1, 3.7.31, 3.7.32, 3.7.33, 3.7.34, 3.7.35, 3.7.36, 3.7.37, 3.7.38, 3.7.39, 3.7.4, 3.7.40, 3.7.40.1, 3.7.41, 3.7.42, 3.7.43, 3.7.44, 3.7.45, 3.7.45.1, 3.7.45.2, 3.7.46, 3.7.47, 3.7.47.1, 3.7.48, 3.7.49, 3.7.5, 3.7.50, 3.7.51, 3.7.52, 3.7.53, 3.7.53.1, 3.7.54, 3.7.55, 3.7.55.1, 3.7.55.2, 3.7.55.3, 3.7.56, 3.7.57, 3.7.58, 3.7.59, 3.7.6, 3.7.60, 3.7.61, 3.7.62, 3.7.63, 3.7.63.1, 3.7.64, 3.7.64.1, 3.7.65, 3.7.65.1, 3.7.65.2, 3.7.66, 3.7.67, 3.7.68, 3.7.7, 3.7.8, 3.7.9, 3.8.0, 3.8.0-beta.1, 3.8.0-beta.2, 3.8.0-beta.3, 3.8.0-beta.4, 3.8.0-beta.5, 3.8.0-beta.6, 3.8.1, 3.8.2, 3.8.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.8.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.0",
"3.0.0.1",
"3.0.0.2",
"3.0.1",
"3.0.10",
"3.0.10.1",
"3.0.10.2",
"3.0.10.3",
"3.0.11",
"3.0.12",
"3.0.13",
"3.0.13.1",
"3.0.13.2",
"3.0.14",
"3.0.15",
"3.0.16",
"3.0.16.1",
"3.0.17",
"3.0.17.1",
"3.0.18",
"3.0.19",
"3.0.2",
"3.0.20",
"3.0.21",
"3.0.22",
"3.0.23",
"3.0.23.1",
"3.0.24",
"3.0.25",
"3.0.26",
"3.0.26.1",
"3.0.27",
"3.0.27.1",
"3.0.28",
"3.0.29",
"3.0.3",
"3.0.3.1",
"3.0.30",
"3.0.30.1",
"3.0.30.2",
"3.0.31",
"3.0.32",
"3.0.33",
"3.0.34",
"3.0.35",
"3.0.36",
"3.0.37",
"3.0.38",
"3.0.39",
"3.0.4",
"3.0.40",
"3.0.40.1",
"3.0.41",
"3.0.41.1",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9",
"3.1.0",
"3.1.0-beta.1",
"3.1.0-beta.2",
"3.1.0-beta.3",
"3.1.0-beta.4",
"3.1.0-beta.5",
"3.1.0-beta.5.1",
"3.1.0-beta.6",
"3.1.0-beta.7",
"3.1.1",
"3.1.10",
"3.1.11",
"3.1.12",
"3.1.13",
"3.1.14",
"3.1.15",
"3.1.16",
"3.1.17",
"3.1.17.1",
"3.1.17.2",
"3.1.18",
"3.1.19",
"3.1.2",
"3.1.2.1",
"3.1.2.2",
"3.1.20",
"3.1.20.1",
"3.1.21",
"3.1.21.1",
"3.1.22",
"3.1.23",
"3.1.24",
"3.1.25",
"3.1.26",
"3.1.27",
"3.1.28",
"3.1.29",
"3.1.3",
"3.1.30",
"3.1.31",
"3.1.32",
"3.1.32.1",
"3.1.33",
"3.1.34",
"3.1.34.1",
"3.1.34.2",
"3.1.34.3",
"3.1.4",
"3.1.5",
"3.1.6",
"3.1.6.1",
"3.1.7",
"3.1.8",
"3.1.9",
"3.1.9.1",
"3.2.0",
"3.2.0-RC1",
"3.2.0-RC2",
"3.2.0-RC3",
"3.2.0-alpha.1",
"3.2.0-alpha.2",
"3.2.0-alpha.2.1",
"3.2.0-alpha.3",
"3.2.0-alpha.4",
"3.2.0-alpha.5",
"3.2.0-alpha.6",
"3.2.0-alpha.6.1",
"3.2.0-alpha.6.2",
"3.2.0-alpha.6.3",
"3.2.0-alpha.6.4",
"3.2.0-alpha.7",
"3.2.0-beta.1",
"3.2.0-beta.2",
"3.2.0-beta.3",
"3.2.1",
"3.2.10",
"3.2.2",
"3.2.3",
"3.2.4",
"3.2.4.1",
"3.2.5",
"3.2.5.1",
"3.2.6",
"3.2.7",
"3.2.8",
"3.2.9",
"3.3.0",
"3.3.0.1",
"3.3.1",
"3.3.1.1",
"3.3.1.2",
"3.3.10",
"3.3.11",
"3.3.12",
"3.3.13",
"3.3.14",
"3.3.15",
"3.3.16",
"3.3.16.1",
"3.3.16.2",
"3.3.16.3",
"3.3.17",
"3.3.18",
"3.3.18.1",
"3.3.18.2",
"3.3.18.3",
"3.3.18.4",
"3.3.19",
"3.3.2",
"3.3.20",
"3.3.20.1",
"3.3.3",
"3.3.4",
"3.3.4.1",
"3.3.5",
"3.3.6",
"3.3.7",
"3.3.8",
"3.3.9",
"3.4.0",
"3.4.0-RC1",
"3.4.0-RC1.1",
"3.4.0-RC2",
"3.4.0-RC3",
"3.4.0-beta.1",
"3.4.0-beta.2",
"3.4.0-beta.3",
"3.4.0-beta.4",
"3.4.0-beta.5",
"3.4.0.1",
"3.4.0.2",
"3.4.1",
"3.4.10",
"3.4.10.1",
"3.4.11",
"3.4.12",
"3.4.13",
"3.4.14",
"3.4.15",
"3.4.16",
"3.4.17",
"3.4.17.1",
"3.4.18",
"3.4.19",
"3.4.19.1",
"3.4.2",
"3.4.20",
"3.4.21",
"3.4.22",
"3.4.22.1",
"3.4.23",
"3.4.24",
"3.4.25",
"3.4.26",
"3.4.27",
"3.4.28",
"3.4.28.1",
"3.4.29",
"3.4.29.1",
"3.4.3",
"3.4.30",
"3.4.4",
"3.4.4.1",
"3.4.5",
"3.4.6",
"3.4.6.1",
"3.4.7",
"3.4.7.1",
"3.4.8",
"3.4.9",
"3.5.0",
"3.5.0-RC1",
"3.5.0-RC1.1",
"3.5.0-RC2",
"3.5.0-RC3",
"3.5.0-RC4",
"3.5.0-RC5",
"3.5.0-RC6",
"3.5.0-beta.1",
"3.5.0-beta.2",
"3.5.0-beta.3",
"3.5.1",
"3.5.10",
"3.5.10.1",
"3.5.11",
"3.5.11.1",
"3.5.12",
"3.5.12.1",
"3.5.13",
"3.5.13.1",
"3.5.13.2",
"3.5.14",
"3.5.15",
"3.5.15.1",
"3.5.16",
"3.5.17",
"3.5.17.1",
"3.5.18",
"3.5.19",
"3.5.19.1",
"3.5.2",
"3.5.3",
"3.5.4",
"3.5.5",
"3.5.6",
"3.5.7",
"3.5.8",
"3.5.9",
"3.6.0",
"3.6.0-RC1",
"3.6.0-RC2",
"3.6.0-RC2.1",
"3.6.0-RC3",
"3.6.0-RC4",
"3.6.0-beta.1",
"3.6.0-beta.1.1",
"3.6.0-beta.2",
"3.6.0.1",
"3.6.1",
"3.6.10",
"3.6.11",
"3.6.11.1",
"3.6.11.2",
"3.6.12",
"3.6.12.1",
"3.6.13",
"3.6.14",
"3.6.15",
"3.6.16",
"3.6.17",
"3.6.18",
"3.6.2",
"3.6.3",
"3.6.4",
"3.6.4.1",
"3.6.5",
"3.6.5.1",
"3.6.6",
"3.6.7",
"3.6.8",
"3.6.9",
"3.7.0",
"3.7.0-beta.1",
"3.7.0-beta.2",
"3.7.0-beta.3",
"3.7.0-beta.4",
"3.7.0-beta.5",
"3.7.0-beta.6",
"3.7.1",
"3.7.10",
"3.7.11",
"3.7.12",
"3.7.13",
"3.7.14",
"3.7.15",
"3.7.16",
"3.7.17",
"3.7.17.1",
"3.7.17.2",
"3.7.18",
"3.7.18.1",
"3.7.18.2",
"3.7.19",
"3.7.19.1",
"3.7.2",
"3.7.20",
"3.7.21",
"3.7.22",
"3.7.23",
"3.7.24",
"3.7.25",
"3.7.25.1",
"3.7.26",
"3.7.27",
"3.7.27.1",
"3.7.27.2",
"3.7.28",
"3.7.29",
"3.7.3",
"3.7.3.1",
"3.7.3.2",
"3.7.30",
"3.7.30.1",
"3.7.31",
"3.7.32",
"3.7.33",
"3.7.34",
"3.7.35",
"3.7.36",
"3.7.37",
"3.7.38",
"3.7.39",
"3.7.4",
"3.7.40",
"3.7.40.1",
"3.7.41",
"3.7.42",
"3.7.43",
"3.7.44",
"3.7.45",
"3.7.45.1",
"3.7.45.2",
"3.7.46",
"3.7.47",
"3.7.47.1",
"3.7.48",
"3.7.49",
"3.7.5",
"3.7.50",
"3.7.51",
"3.7.52",
"3.7.53",
"3.7.53.1",
"3.7.54",
"3.7.55",
"3.7.55.1",
"3.7.55.2",
"3.7.55.3",
"3.7.56",
"3.7.57",
"3.7.58",
"3.7.59",
"3.7.6",
"3.7.60",
"3.7.61",
"3.7.62",
"3.7.63",
"3.7.63.1",
"3.7.64",
"3.7.64.1",
"3.7.65",
"3.7.65.1",
"3.7.65.2",
"3.7.66",
"3.7.67",
"3.7.68",
"3.7.7",
"3.7.8",
"3.7.9",
"3.8.0",
"3.8.0-beta.1",
"3.8.0-beta.2",
"3.8.0-beta.3",
"3.8.0-beta.4",
"3.8.0-beta.5",
"3.8.0-beta.6",
"3.8.1",
"3.8.2",
"3.8.3"
]
}From 4.0.0 before 4.4.4
Fixed in 4.4.4
60 explicitly affected versions
4.0.0, 4.0.0.1, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.5.1, 4.0.5.2, 4.0.6, 4.1.0, 4.1.0.1, 4.1.0.2, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.4.1, 4.2.0, 4.2.0.1, 4.2.0.2, 4.2.1, 4.2.1.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.5.1, 4.2.5.2, 4.2.6, 4.2.7, 4.2.8, 4.3.0, 4.3.1, 4.3.10, 4.3.11, 4.3.2, 4.3.2.1, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.6.1, 4.3.7, 4.3.7.1, 4.3.8, 4.3.8.1, 4.3.8.2, 4.3.9, 4.4.0, 4.4.0-beta.1, 4.4.0-beta.2, 4.4.0-beta.3, 4.4.0-beta.4, 4.4.0-beta.5, 4.4.0-beta.6, 4.4.0-beta.7, 4.4.1, 4.4.2, 4.4.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.4.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.0",
"4.0.0.1",
"4.0.1",
"4.0.2",
"4.0.3",
"4.0.4",
"4.0.5",
"4.0.5.1",
"4.0.5.2",
"4.0.6",
"4.1.0",
"4.1.0.1",
"4.1.0.2",
"4.1.1",
"4.1.2",
"4.1.3",
"4.1.4",
"4.1.4.1",
"4.2.0",
"4.2.0.1",
"4.2.0.2",
"4.2.1",
"4.2.1.1",
"4.2.2",
"4.2.3",
"4.2.4",
"4.2.5",
"4.2.5.1",
"4.2.5.2",
"4.2.6",
"4.2.7",
"4.2.8",
"4.3.0",
"4.3.1",
"4.3.10",
"4.3.11",
"4.3.2",
"4.3.2.1",
"4.3.3",
"4.3.4",
"4.3.5",
"4.3.6",
"4.3.6.1",
"4.3.7",
"4.3.7.1",
"4.3.8",
"4.3.8.1",
"4.3.8.2",
"4.3.9",
"4.4.0",
"4.4.0-beta.1",
"4.4.0-beta.2",
"4.4.0-beta.3",
"4.4.0-beta.4",
"4.4.0-beta.5",
"4.4.0-beta.6",
"4.4.0-beta.7",
"4.4.1",
"4.4.2",
"4.4.3"
]
}References
- https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6
- https://nvd.nist.gov/vuln/detail/CVE-2023-31144
- https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442
- https://github.com/craftcms/cms/commit/e2f7e7b7d86a0afa54ce855375d13c7760670764
- https://github.com/craftcms/cms