CVE-2023-33197

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80 CWE-79

Affected software

Vendor	Product	Versions
craftcms	cms	>= 4.0.0-RC1, <= 4.4.5

References

https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766Patch
https://github.com/craftcms/cms/releases/tag/4.4.6Release Notes
https://github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxrExploit, Patch, Vendor Advisory
https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766Patch
https://github.com/craftcms/cms/releases/tag/4.4.6Release Notes
https://github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxrExploit, Patch, Vendor Advisory

Timeline

Published: May 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-331987.5tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poiso CVE-2023-331995.3Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed CVE-2023-33208.8The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due CVE-2023-332004.7A local non-privileged user can make improper GPU processing operations to exploit a software race condition. If the system’s memory is care CVE-2023-332015.3Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an L CVE-2023-332025.5Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMP CVE-2023-332036.4The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically CVE-2023-332047.8sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incompl CVE-2023-332066.8Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR16, 4.0.0 SR06, 4.1.0 SR04, 4.2.0 SR03, and 4.3.0 SR01 fails to validate symlink CVE-2023-332078.8Cross-Site Request Forgery (CSRF) vulnerability in Krzysztof Wielogórski Stop Referrer Spam plugin <= 1.3.0 versions.CVE-2023-332084.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gsmith Cookie Monster plugin <= 1.51 versions.CVE-2023-332098.1Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CrawlSpider SEO Change Monitor – Track