Cross-site Scripting (XSS) in CrafterCMS

MEDIUM 6.1CVE-2023-4136 · GHSA-jfm4-3vv3-fm4v · Published 03/08/2023 · updated 17/06/2026

In short

CVE-2023-4136 is a MEDIUM (CVSS 6.1) vulnerability affecting org.craftercms:crafter-engine, craftercms (craftercms).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.8% of all vulnerabilities.
Fix: update to 3.1.28, 4.0.3 or later.

Package	Affected versions	Patched versions
org.craftercms:crafter-engine Maven	`≥ 3.1.0, < 3.1.28≥ 4.0.0, < 4.0.3`	`3.1.284.0.3`
craftercms craftercms	`≥ 3.1.0, ≤ 3.1.27≥ 4.0.0, ≤ 4.0.2`	No fix yet

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2023-4136 · ADVISORY
docs.craftercms.org/en/4.0/security/advisory.html · WEB
craftercms/engine · PACKAGE
packetstormsecurity.com/files/174304/CrafterCMS-4.0.2-Cross-Site-Scripting.html · WEB
seclists.org/fulldisclosure/2023/Aug/30 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free