{"id":"CVE-2022-37251","aliases":["EUVD-2022-6883","GHSA-mw37-wx8p-gp45"],"status":"published","title":"Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts","description":"Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00512,"percentile":0.44019,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-09-16T20:54:16Z","modified":"2026-10-28T02:30:52Z","fixes":[{"ecosystem":"Packagist","package":"craftcms/cms","fixed_in":["3.7.55.2","4.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"craftcms/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0-beta.1"},{"fixed":"3.7.55.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"craftcms/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-RC1"},{"fixed":"4.2.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"craftcms/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0-beta.1"},{"fixed":"3.7.55.2"}]}],"versions":["3.7.0","3.7.0-beta.1","3.7.0-beta.2","3.7.0-beta.3","3.7.0-beta.4","3.7.0-beta.5","3.7.0-beta.6","3.7.1","3.7.10","3.7.11","3.7.12","3.7.13","3.7.14","3.7.15","3.7.16","3.7.17","3.7.17.1","3.7.17.2","3.7.18","3.7.18.1","3.7.18.2","3.7.19","3.7.19.1","3.7.2","3.7.20","3.7.21","3.7.22","3.7.23","3.7.24","3.7.25","3.7.25.1","3.7.26","3.7.27","3.7.27.1","3.7.27.2","3.7.28","3.7.29","3.7.3","3.7.3.1","3.7.3.2","3.7.30","3.7.30.1","3.7.31","3.7.32","3.7.33","3.7.34","3.7.35","3.7.36","3.7.37","3.7.38","3.7.39","3.7.4","3.7.40","3.7.40.1","3.7.41","3.7.42","3.7.43","3.7.44","3.7.45","3.7.45.1","3.7.45.2","3.7.46","3.7.47","3.7.47.1","3.7.48","3.7.49","3.7.5","3.7.50","3.7.51","3.7.52","3.7.53","3.7.53.1","3.7.54","3.7.55","3.7.55.1","3.7.6","3.7.7","3.7.8","3.7.9"]},{"source":"osv","ecosystem":"Packagist","package":"craftcms/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-RC1"},{"fixed":"4.2.1"}]}],"versions":["4.0.0","4.0.0-RC1","4.0.0-RC2","4.0.0-RC3","4.0.0.1","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.5.1","4.0.5.2","4.0.6","4.1.0","4.1.0.1","4.1.0.2","4.1.1","4.1.2","4.1.3","4.1.4","4.1.4.1","4.2.0","4.2.0.1","4.2.0.2"]}],"products":[{"vendor":"craftcms","product":"craft_cms"}],"references":[{"url":"https://labs.integrity.pt/advisories/cve-2022-37251/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37251","tags":["advisory"]},{"url":"https://github.com/craftcms/cms/commit/919c9074ff8596bf30a629b0888c529793e9a903","tags":["web"]},{"url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#421---2022-08-09","tags":["web"]},{"url":"https://github.com/craftcms/cms/commit/7139213dbd9e177a3528aac8e2db8de91830f118","tags":["web"]},{"url":"https://github.com/craftcms/cms/commit/f0d9b8a1e3ac005a2418f7d3d9059b49a96e73ea","tags":["web"]},{"url":"http://craft.com","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mw37-wx8p-gp45"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37251.json","tags":["advisory"]},{"url":"https://github.com/craftcms/cms","tags":["package"]},{"url":"https://labs.integrity.pt/advisories/cve-2022-37251","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-37251","description":"Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.","status":"published","published":"2022-09-16T20:54:16Z","modified":"2026-07-09T00:20:38.787Z","updated_at":"2026-11-02T14:34:26.977054Z"}],"euvd":[{"id":"EUVD-2022-6883","description":"Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.","status":"published","published":"2022-09-16T20:54:16Z","modified":"2026-07-09T00:20:38Z","updated_at":"2026-11-02T18:20:07.281662Z"}],"ghsa":[{"id":"GHSA-mw37-wx8p-gp45","title":"Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts","description":"Craft CMS `3.70-RC1`–`3.7.55.1` and `4.0.0-RC1`–`4.2.0.1` are vulnerable to Cross Site Scripting (XSS) via entry revisions and drafts. Versions `3.7.55.2` and `4.2.1` contain patches for this issue.","status":"published","published":"2022-09-17T00:00:30Z","modified":"2023-02-03T05:06:14Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:43.439065Z"}],"nvd":[{"id":"CVE-2022-37251","description":"Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.","status":"published","published":"2022-09-16T22:15:12.057Z","modified":"2026-07-09T01:17:38.333Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:28.118799Z"}],"osv":[{"id":"GHSA-mw37-wx8p-gp45","title":"Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts","description":"Craft CMS `3.70-RC1`–`3.7.55.1` and `4.0.0-RC1`–`4.2.0.1` are vulnerable to Cross Site Scripting (XSS) via entry revisions and drafts. Versions `3.7.55.2` and `4.2.1` contain patches for this issue.","status":"published","published":"2022-09-17T00:00:30Z","modified":"2024-02-21T05:28:42.912868Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"CVE-2022-37251","description":"Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.","status":"published","published":"2022-09-16T20:54:16Z","modified":"2026-10-28T02:30:52.440363246Z","updated_at":"2026-11-02T15:44:26.53798Z"}]}}