CVE-2022-37251

MediumCVSS 5.4

Published: 16/09/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

33th percentile - higher than 33% of all known CVEs

Summary

Craft CMS version 4.2.0.1 is vulnerable to Cross-Site Scripting (XSS) via the Drafts feature. An attacker can inject a malicious script that will be executed in the victim's browser.

Risk Assessment

The risk involves potential session theft, account takeover, or unauthorized actions performed in the victim's context. This could lead to data leakage or system integrity compromise.

Recommendation

It is recommended to immediately update Craft CMS to the latest stable version that fixes this vulnerability. Also, restrict access to the Drafts feature to trusted users only.

Original NVD description (English source)

Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.