CVE-2022-37248: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-09-16T16:15Z
Repository: https://github.com/craftcms/cms
Language: PHP
Files changed: CHANGELOG.md, src/helpers/Cp.php, src/templates/settings/fields/index.twig
Commit date: 2022-07-28 16:17:53 -0700
Commit message: More XSS vulnerabilities

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4dfeebb9f27..a244e44643d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,11 +16,11 @@
 - Fixed a bug where database connections would always use port `3306` by default if `craft\config\DbConfig` had been configured via fluent methods, even for PostgreSQL.
 - Fixed a bug where system messages provided by Yii weren’t getting translated in some cases. ([#11712](https://github.com/craftcms/cms/issues/11712))
 - Fixed a bug where the “Keep me signed in” checkbox label wasn’t always accurately representing the `rememberedUserSessionDuration` config setting. ([#11594](https://github.com/craftcms/cms/discussions/11594))
 
 ### Security
-- Fixed an XSS vulnerability.
+- Fixed XSS vulnerabilities.
 
 ## 4.2.0.2 - 2022-07-27
 
 ### Fixed
 - Fixed a bug where `Garnish.uiShortcutManager` was getting double-instantiated, causing some keyboard shortcuts to be triggered multiple times.
diff --git a/src/helpers/Cp.php b/src/helpers/Cp.php
index cf2648a0bbc..d3722fa1940 100644
--- a/src/helpers/Cp.php
+++ b/src/helpers/Cp.php
@@ -1618,11 +1618,11 @@ JS;
                     'tab',
                     'sel',
                     $customizable ? 'draggable' : null,
                 ]),
             ]) .
-            Html::tag('span', $tab->name) .
+            Html::tag('span', Html::encode($tab->name)) .
             ($customizable
                 ? Html::a('', null, [
                     'role' => 'button',
                     'class' => ['settings', 'icon'],
                     'title' => Craft::t('app', 'Edit'),
@@ -1720,11 +1720,11 @@ JS;
                     'fld-field-group',
                     $showGroup ? null : 'hidden',
                 ]),
                 'data' => ['name' => mb_strtolower($groupName)],
             ]) .
-            Html::tag('h6', $groupName) .
+            Html::tag('h6', Html::encode($groupName)) .
             implode('', array_map(fn(BaseField $field) => self::_fldElementSelectorHtml($field, true, [
                 'class' => array_filter([
                     $fieldLayout->isFieldIncluded($field->attribute()) ? 'hidden' : null,
                 ]),
             ]), $groupFields)) .
diff --git a/src/templates/settings/fields/index.twig b/src/templates/settings/fields/index.twig
index 6cc9c016b22..b380beb24e4 100644
--- a/src/templates/settings/fields/index.twig
+++ b/src/templates/settings/fields/index.twig
@@ -98,11 +98,11 @@
         handle: field.handle,
         type: {
             isMissing: fieldIsMissing,
             label: fieldIsMissing ? field.expectedType : field.displayName()
         },
-        group: group ? group.name|t('site') : "<span class=\"error\">#{'(Ungrouped)'|t('app')}</span>",
+        group: group ? group.name|t('site')|e : "<span class=\"error\">#{'(Ungrouped)'|t('app')}</span>",
     }]) %}
 {% endfor %}
 
 {% js %}
     var columns = [

Vulnerable code: - Fixed an XSS vulnerability.
            Html::tag('span', $tab->name) .
            Html::tag('h6', $groupName) .
        group: group ? group.name|t('site') : "<span class=\"error\">#{'(Ungrouped)'|t('app')}</span>",
Fixed code: - Fixed XSS vulnerabilities.
            Html::tag('span', Html::encode($tab->name)) .
            Html::tag('h6', Html::encode($groupName)) .
        group: group ? group.name|t('site')|e : "<span class=\"error\">#{'(Ungrouped)'|t('app')}</span>",