Craft CMS Audit Plugin Cross Site Scripting vulnerability

MITTEL 5.4CVE-2023-36259 · GHSA-v89q-c273-3p42 · Published 30/01/2024 · updated 17/06/2026

Kurz gesagt

CVE-2023-36259 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in superbig/craft-audit, craft cms (craftcms).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.38%, höher als bei 32.0% aller Schwachstellen.
Abhilfe: auf 3.0.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
superbig/craft-audit Packagist	`< 3.0.2`	`3.0.2`
craft cms craftcms	`< 3.0.2`	`3.0.2`

Description

Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.

NVD description

Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.

References

nvd.nist.gov/vuln/detail/CVE-2023-36259 · ADVISORY
sjelfull/craft-audit#73 · WEB
sjelfull/craft-audit commit c2888aa · WEB
sjelfull/craft-audit · PACKAGE
linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free