GitHub Advisoryadvisory · Packagist

GHSA-8jjh-j3c2-cjcv Cross-site Scripting via uploaded assets

HIGH Published 2023-11-22 Modified 2023-11-22 Official page ↗
Aliases
CVE-2023-48701
Ecosystem
Packagist
Packages
statamic/cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H
Weaknesses
CWE-79
Reviewed
2023-11-22

Affected packages

• Packagist statamic/cms: < 3.4.15 → fixed in 3.4.15 • Packagist statamic/cms: >= 4.0.0, < 4.36.0 → fixed in 4.36.0

Description

Impact HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. Patches It has been patched on 3.4.15 and 4.36.0.

Related

Alias · CVE (1)

  • CVE-2023-48701 Statamic CMS is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References