CVE-2022-37247 - Stored XSS in Fields in Craft CMS

1. Vulnerability Properties

Title: Stored XSS in Fields in Craft CMS
CVE ID: CVE-2022-37247
CVSSv3 Base Score: 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Vendor: Craft CMS
Products: Craft CMS
Advisory Release Date: 7 Sep 2022
Advisory URL: https://labs.integrity.pt/advisories/cve-2022-37247
Credits: Discovery by Gil Correia <gil.correia[at]devoteam.com>

2. Vulnerability Summary

In this XSS the attacker needs to add to the path /admin/settings/fields and from there add a “New group” with the payload. After this action, it needs to create a “New field” and select the group with the payload inserted in the previous step. This new field will now reflect the payload everywhere it appears.

3. Vulnerable Versions

  • 4.2.0.1

4. Solution

  • Update to version 4.2.1 or higher

5. Vulnerability Timeline

  • 28/07/22 -Vulnerability reported to Craft CMS via their report page.
  • 29/07/22 -Vulnerability verified by vendor.
  • 29/07/22 -Vulnerability fixed by vendor.
  • 07/09/22 -Advisory released.

6. References

  • https://github.com/craftcms/cms/commit/cedeba0609e4b173cd584dae7f33c5f713f19627


© 2022 Integrity Part of Devoteam. All rights reserved. | Cookie Policy

Cookie Consent X

Integrity S.A. uses cookies for analytical and more personalized information presentation purposes, based on your browsing habits and profile. For more detailed information, see our Cookie Policy.