GitHub Advisoryadvisory · Packagist

GHSA-68q3-7wjp-7q3j The filename of uploaded files vulnerable to stored XSS

HIGH Published 2020-06-09 Modified 2022-10-07 Official page ↗
Aliases
CVE-2020-4041
Ecosystem
Packagist
Packages
bolt/bolt
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weaknesses
CWE-79
Reviewed
2020-06-08

Affected packages

• Packagist bolt/bolt: < 3.7.1 → fixed in 3.7.1

Description

Impact The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. Patches This is fixed in Bolt 3.7.1. References Related issue: https://github.com/bolt/bolt/pull/7853

Related

Alias · CVE (1)

  • CVE-2020-4041 In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References