{"id":"CVE-2023-33197","aliases":["EUVD-2023-1487","GHSA-6qjx-787v-6pxr"],"status":"published","title":"Craft CMS stored XSS in indexedVolumes","description":"Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00681,"percentile":0.52742,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-80"],"published":"2023-05-26T13:56:26Z","modified":"2026-10-28T02:30:41Z","fixes":[{"ecosystem":"Packagist","package":"craftcms/cms","fixed_in":["4.4.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"craftcms/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-RC1"},{"last_affected":"4.4.5"},{"fixed":"4.4.6"}]}]},{"source":"osv","ecosystem":"Packagist","package":"craftcms/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-RC1"},{"fixed":"4.4.6"}]}],"versions":["4.0.0","4.0.0-RC1","4.0.0-RC2","4.0.0-RC3","4.0.0.1","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.5.1","4.0.5.2","4.0.6","4.1.0","4.1.0.1","4.1.0.2","4.1.1","4.1.2","4.1.3","4.1.4","4.1.4.1","4.2.0","4.2.0.1","4.2.0.2","4.2.1","4.2.1.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.5.1","4.2.5.2","4.2.6","4.2.7","4.2.8","4.3.0","4.3.1","4.3.10","4.3.11","4.3.2","4.3.2.1","4.3.3","4.3.4","4.3.5","4.3.6","4.3.6.1","4.3.7","4.3.7.1","4.3.8","4.3.8.1","4.3.8.2","4.3.9","4.4.0","4.4.0-beta.1","4.4.0-beta.2","4.4.0-beta.3","4.4.0-beta.4","4.4.0-beta.5","4.4.0-beta.6","4.4.0-beta.7","4.4.1","4.4.2","4.4.3","4.4.4","4.4.5"]}],"products":[{"vendor":"craftcms","product":"cms"},{"vendor":"craftcms","product":"craft_cms"},{"vendor":"statamic","product":"cms"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxr","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/craftcms/cms/releases/tag/4.4.6","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33197","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6qjx-787v-6pxr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33197.json","tags":["advisory"]},{"url":"https://github.com/craftcms/cms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-33197","title":"Craft CMS stored XSS in indexedVolumes","description":"Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.\n","status":"published","published":"2023-05-26T19:17:23.375Z","modified":"2025-01-14T19:32:21.443Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:35:34.55015Z"}],"euvd":[{"id":"EUVD-2023-1487","description":"Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.\n","status":"published","published":"2023-05-26T19:17:23Z","modified":"2025-01-14T19:32:21Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:19.424496Z"}],"ghsa":[{"id":"GHSA-6qjx-787v-6pxr","title":"Craft CMS stored XSS in indexedVolumes","description":"### Summary\nXSS can be triggered via the Update Asset Index utility\n\n### PoC\n1. Access setting tab\n2. Create new assets\n3. In assets name inject payload: \"\u003cscript\u003ealert(26)\u003c/script\u003e\n4. Click Utilities tab\n5. Choose all volumes, or volume trigger xss\n7. Click Update asset indexes.\n\nXSS will be triggered\n\nJson response volumes name makes triggers the payload\n\n    \"session\":{\"id\":1,\"indexedVolumes\":{\"1\":\"\\\"\u003cscript\u003ealert(26)\u003c/script\u003e\"},\n\nIt’s run on every POST request in the utility.\n\nResolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766\n\n","status":"published","published":"2023-05-26T13:56:26Z","modified":"2023-11-08T05:05:57Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T14:37:16.721714Z"}],"nvd":[{"id":"CVE-2023-33197","description":"Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.\n","status":"published","published":"2023-05-26T20:15:48.6Z","modified":"2026-06-17T06:01:17.287Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-80","CWE-79"],"updated_at":"2026-11-02T14:08:03.200773Z"}],"osv":[{"id":"CVE-2023-33197","title":"Craft CMS stored XSS in indexedVolumes","description":"Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.\n","status":"published","published":"2023-05-26T19:17:23.375Z","modified":"2026-10-28T02:30:41.979568552Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T15:44:32.116263Z"},{"id":"GHSA-6qjx-787v-6pxr","title":"Craft CMS stored XSS in indexedVolumes","description":"### Summary\nXSS can be triggered via the Update Asset Index utility\n\n### PoC\n1. Access setting tab\n2. Create new assets\n3. In assets name inject payload: \"\u003cscript\u003ealert(26)\u003c/script\u003e\n4. Click Utilities tab\n5. Choose all volumes, or volume trigger xss\n7. Click Update asset indexes.\n\nXSS will be triggered\n\nJson response volumes name makes triggers the payload\n\n    \"session\":{\"id\":1,\"indexedVolumes\":{\"1\":\"\\\"\u003cscript\u003ealert(26)\u003c/script\u003e\"},\n\nIt’s run on every POST request in the utility.\n\nResolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766\n\n","status":"published","published":"2023-05-26T13:56:26Z","modified":"2026-09-10T03:50:01.280788657Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T15:46:39.965326Z"}]}}