TI-2022-17560 Aliases CVE-2022-37783 GHSA-h972-v458-m892

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who…

HIGH 66CWE-522Published 2022-12-05 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-522.

Summary

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01109 66th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed craftcms/cms (Packagist): 3.7.33

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	craftcms/cms (Packagist)	3.0.0 to before 3.7.33	3.7.33	Patch available	GHSA-h972-v458-m892

— Vendor— Affected all versions Fixed in — No fix listed CNA
craftcms/cms (Packagist) Vendor— Affected 3.0.0 to before 3.7.33 Fixed in 3.7.33 Patch available GHSA-h972-v458-m892

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:craftcms:craft_cms::::::::	3.0.0 – 3.7.32	Vulnerable	Craft CMS

cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.7.32 Vulnerable ·Craft CMS

Remediation

Fix · GHSA-h972-v458-m892 craftcms/cms (Packagist) Fixed in 3.7.33 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-37783
2026-10-03 Alias added: GHSA-h972-v458-m892

References

Exploit 1

https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes/

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-37783

Other 5

TI-2025-23503 Craft CMS Allows Remote Code Execution KEVCVSS 3.1CRITICAL 10.0
TI-2024-37138 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms KEVCVSS 4.0CRITICAL 9.3
TI-2025-16994 Potential RCE with a compromised security key in craft/cms KEVCVSS 3.1HIGH 8.1
TI-2025-24595 Craft CMS stores user-provided content in session files KEVCVSS 4.0MEDIUM 6.9
TI-2023-22284 Craft CMS Remote Code Execution vulnerability CVSS 3.1CRITICAL 10.0
TI-2024-25171 Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. CVSS 3.1CRITICAL 9.8

See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences