Skip to content
Fencer Intel
low —

GHSA-wf98-vxv9-jqfv json

XSS Injection Vulnerability

published 4y ago modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied.

### Patches

This has been patched in Craft 3.7.29.

### References

* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18

### For more information

If you have any questions or comments about this advisory, email us at [support@craftcms.com](mailto:support@craftcms.com)

----------

Credits: https://github.com/noobpk

Patch / fix

  • packagist craftcms/cms 3.7.29

Is GHSA-wf98-vxv9-jqfv in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist craftcms/cms
<3.7.29
3.7.29

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.