Description
Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | < 4.3.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | craftcms/cms | >= 4.0.0-RC1, < 4.3.7 | 4.3.7 | GHSA-qcrj-6ffc-v7hq |
| Packagist | craftcms/cms | >= 3.7.24, < 3.7.64 | 3.7.64 | GHSA-qcrj-6ffc-v7hq |