CVE-2023-33196: 
PHP vulnerability analysis and mitigation

Craft CMS, a content management system for creating custom digital experiences, was found to be vulnerable to Cross-Site Scripting (XSS) that could be triggered by review volumes. The vulnerability, identified as CVE-2023-33196, affects versions from 4.0.0-RC1 through 4.4.6 and was fixed in version 4.4.7. The issue was discovered and reported by WhiteBearVN (GitHub Advisory).

The vulnerability is a stored XSS issue that occurs when processing asset indexing sessions. The vulnerability exists due to insufficient filtering of 'skippedEntries' and 'missingEntries' parameters in the asset indexing functionality. When processing the indexing session response, these parameters were not properly sanitized, allowing for the injection of malicious JavaScript code. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L (GitHub Advisory).

The vulnerability could allow attackers to execute arbitrary JavaScript code in the context of other users' browsers who access the affected pages. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (GitHub Advisory).

The vulnerability has been patched in Craft CMS version 4.4.7. Users are strongly advised to upgrade to this version or later to address the security issue. The fix was implemented in commit 053d711 (GitHub Commit).