{"id":"CVE-2023-30177","details":"CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.","aliases":["GHSA-wv7j-rc2q-9j67"],"modified":"2026-08-12T03:51:11.537250680Z","published":"2023-04-25T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30177.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30177.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30177"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/00fb253d5318e10204433e5d93934108e574005e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/craftcms/cms","events":[{"introduced":"b3e6247db27b315615c02dad6dab89ecd9233d89"},{"fixed":"00fb253d5318e10204433e5d93934108e574005e"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:craftcms:craft_cms:3.7.59:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.7.59"},{"last_affected":"3.7.59"}]}}],"versions":["3.7.59","3.7.64","3.7.67","3.7.66","3.7.65.2","3.7.65.1","3.7.65","3.7.64.1","3.7.63.1","3.7.63","3.7.62","3.7.61","3.7.60"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30177.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}