CVE-2023-38904

MediumCVSS 5.4

Published: 16/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.63%

45th percentile - higher than 45% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payload to the body parameter of the new post function.

Risk Assessment

This vulnerability could lead to account takeover or data theft, posing a significant security risk to the organization.

Recommendation

It is recommended to update Netlify CMS to the latest version to mitigate this vulnerability and to monitor the application for suspicious activities.

Original NVD description (English source)

A Cross Site Scripting (XSS) vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payload to the body parameter of the new post function.