Craft CMS Audit Plugin Cross Site Scripting vulnerability

보통 5.4CVE-2023-36259 · GHSA-v89q-c273-3p42 · Published 30/01/2024 · updated 17/06/2026

요약

CVE-2023-36259은(는) superbig/craft-audit, craft cms (craftcms)에 영향을 주는 보통 (CVSS 5.4) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.38%, 전체 취약점의 32.0%보다 높음.
조치: 3.0.2 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
superbig/craft-audit Packagist	`< 3.0.2`	`3.0.2`
craft cms craftcms	`< 3.0.2`	`3.0.2`

Description

Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.

NVD description

Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.

References

nvd.nist.gov/vuln/detail/CVE-2023-36259 · ADVISORY
sjelfull/craft-audit#73 · WEB
sjelfull/craft-audit commit c2888aa · WEB
sjelfull/craft-audit · PACKAGE
linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free