CVE-2022-28378: 
PHP vulnerability analysis and mitigation

Craft CMS before version 3.7.29 was found to be vulnerable to Cross-Site Scripting (XSS). The vulnerability was disclosed on April 3, 2022, and was assigned identifier CVE-2022-28378. This security issue affects all installations of Craft CMS running versions prior to 3.7.29 (NVD, MITRE).

The vulnerability has been assessed with a CVSS v3.1 Base Score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The CVSS v2.0 Base Score is 4.3 (MEDIUM) with vector (AV:N/AC:M/Au:N/C:N/I:P/A:N). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The XSS vulnerability could allow attackers to execute malicious scripts in a user's browser context, potentially leading to theft of sensitive information, session hijacking, or other client-side attacks. The CVSS scores indicate that while the vulnerability requires user interaction, it can affect confidentiality and integrity with low impact (NVD).

The vulnerability is network accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N), but does need user interaction (UI:R) to be exploited. The scope is changed (S:C), indicating that the vulnerable component impacts components beyond its security scope (NVD).

The vulnerability was fixed in Craft CMS version 3.7.29. Users are advised to upgrade their Craft CMS installations to version 3.7.29 or later to mitigate this security issue (Craft Changelog).