Craftcms Craft Cms vulnerabilities, page 2
97 vulnerabilities
Known vulnerabilities in Craftcms Craft Cms, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-37783craftcmscraft_cms
EPSS score1.11%
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.CVE-2022-37250craftcmscraft_cmsEPSS score0.67%
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.CVE-2022-37246craftcmscraft_cmsEPSS score0.52%
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.CVE-2022-37248craftcmscraft_cmsEPSS score0.66%
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.CVE-2022-37251craftcmscraft_cmsEPSS score0.50%
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.CVE-2022-37247craftcmscraft_cmsEPSS score0.57%
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.CVE-2022-29933craftcmscraft_cmsEPSS score4.58%
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).CVE-2022-28378craftcmscraft_cmsEPSS score0.63%
Craft CMS before 3.7.29 allows XSS.CVE-2017-9516craftcmscraft_cmsEPSS score2.80%
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.CVE-2017-8052craftcmscraft_cmsEPSS score0.83%
Craft CMS before 2.6.2974 allows XSS attacks.CVE-2017-8383craftcmscraft_cmsEPSS score1.15%
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.CVE-2017-8384craftcmscraft_cmsEPSS score0.84%
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.CVE-2017-8385craftcmscraft_cmsEPSS score0.96%
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.CVE-2024-21622craftcmscms+1EPSS score0.59%
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.CVE-2024-52291craftcmscms+1EPSS score1.18%
Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access to sensitive files, and, under certain conditions, remote code execution (RCE) via Server-Side Template Injection (SSTI) payloads. Note that this will only work if you have an authenticated administrator account with allowAdminChanges enabled. This is fixed in 5.4.6 and 4.12.5.CVE-2024-52293craftcmscms+1EPSS score1.36%
Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.CVE-2024-52292craftcmscms+1EPSS score0.75%
Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notification. Once the email is received, the Base64 payload can be decoded, allowing the attacker to read arbitrary files on the server. This is fixed in 5.4.9 and 4.12.8.CVE-2024-41800craftcmscms+1EPSS score0.46%
Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.CVE-2024-37843craftcmscraft_cmsEPSS score53.24%
Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.CVE-2024-56145craftcmscms+1KEVEPSS score97.41%
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.