CVE-2023-33197

MediumCVSS 5.5

Published: 26/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.68%

48th percentile - higher than 48% of all known CVEs

Summary

Craft is a content management system (CMS) for creating custom digital experiences on the web. A cross-site scripting (XSS) vulnerability has been identified that can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.

Risk Assessment

An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking. Organizations should update their systems to mitigate this risk.

Recommendation

It is recommended to update Craft to version 4.4.6 or later to eliminate this vulnerability. Regular monitoring and updating of software is crucial for maintaining security.

Original NVD description (English source)

Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.