{"id":"CVE-2023-4136","aliases":["EUVD-2023-54018","GHSA-jfm4-3vv3-fm4v"],"status":"published","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0142,"percentile":0.73002,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-08-03T13:33:10Z","modified":"2026-06-17T06:37:09Z","exploits":[{"source":"nuclei","id":"CVE-2023-4136","title":"CrafterCMS Engine - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4136.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.craftercms:crafter-engine","fixed_in":["4.0.3","3.1.28"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.craftercms:crafter-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.craftercms:crafter-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.28"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.craftercms:crafter-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.3"}]}],"versions":["4.0.1","4.0.2"]},{"source":"osv","ecosystem":"Maven","package":"org.craftercms:crafter-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.28"}]}],"versions":["3.1.0","3.1.1","3.1.10","3.1.10E","3.1.11","3.1.11E","3.1.12","3.1.12E","3.1.13","3.1.13E","3.1.14","3.1.14E","3.1.15","3.1.15E","3.1.16","3.1.16E","3.1.17","3.1.17.4","3.1.17.4E","3.1.17.5","3.1.17.5E","3.1.17.6","3.1.17.6E","3.1.17.7","3.1.17.7E","3.1.17E","3.1.18","3.1.18E","3.1.19","3.1.19E","3.1.2","3.1.20","3.1.20E","3.1.21","3.1.21E","3.1.22","3.1.22E","3.1.23","3.1.23E","3.1.24","3.1.24E","3.1.25","3.1.25E","3.1.26","3.1.26E","3.1.27","3.1.27E","3.1.3","3.1.4","3.1.4E","3.1.5","3.1.5E","3.1.6","3.1.6E","3.1.7","3.1.7E","3.1.8","3.1.8E","3.1.9","3.1.9E"]}],"products":[{"vendor":"craftercms","product":"craftercms"}],"references":[{"url":"https://docs.craftercms.org/en/4.0/security/advisory.html#cv-2023080301","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2023/Aug/30","tags":["x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/174304/CrafterCMS-4.0.2-Cross-Site-Scripting.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4136","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jfm4-3vv3-fm4v"},{"url":"https://github.com/craftercms/engine","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-4136","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.","status":"published","published":"2023-08-03T13:33:10.409Z","modified":"2025-02-13T17:09:02.003Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:30.474787Z"}],"euvd":[{"id":"EUVD-2023-54018","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.","status":"published","published":"2023-08-03T13:33:10Z","modified":"2025-02-13T17:09:02Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:03:49.098775Z"}],"ghsa":[{"id":"GHSA-jfm4-3vv3-fm4v","title":"Cross-site Scripting (XSS) in CrafterCMS","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.","status":"published","published":"2023-08-03T18:30:35Z","modified":"2025-02-13T20:14:28Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:31.416868Z"}],"nvd":[{"id":"CVE-2023-4136","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.","status":"published","published":"2023-08-03T15:15:34.167Z","modified":"2026-06-17T06:37:09.62Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:20.798312Z"}],"osv":[{"id":"CVE-2023-4136","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.","status":"published","published":"2023-08-03T15:15:34.167Z","modified":"2026-04-10T05:02:54.919788Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"GHSA-jfm4-3vv3-fm4v","title":"Cross-site Scripting (XSS) in CrafterCMS","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.","status":"published","published":"2023-08-03T18:30:35Z","modified":"2025-02-13T20:27:05.028292Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:50.336262Z"}]}}