CVE-2023-41892

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Sep 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-418935.4Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable CVE-2023-418945.3Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable vCVE-2023-418959.6Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials aCVE-2023-418969.0Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_calCVE-2023-418979.6Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-OptionCVE-2023-418987.8Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitCVE-2023-418997.2Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side RequeCVE-2023-41906.5Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.CVE-2023-419004.3Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authenticatCVE-2023-419027.8An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by CVE-2023-419045.4Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.CVE-2023-419055.4NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user.