Description
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of any higher-privileged user viewing the affected element, allowing account creation and other authenticated actions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | 5.0.0-RC1 – < 5.10.8 | 5.10.8 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | craftcms/cms | >= 5.0.0-RC1, < 5.10.8 | 5.10.8 | GHSA-2rp4-x2j7-qmcc |
References
- GitHub Security Advisory (GHSA-2rp4-x2j7-qmcc) vendor-advisory
- VulnCheck Advisory: Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name third-party-advisory