GitHub Advisoryadvisory · Packagist

GHSA-mrwr-2945-fr22 Cross-site scripting in PageKit

MEDIUM Published 2021-06-22 Modified 2021-06-23 Official page ↗
Aliases
CVE-2021-32245
Ecosystem
Packagist
Packages
pagekit/pagekit
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-06-17

Affected packages

• Packagist pagekit/pagekit: <= 1.0.18 (no fix yet)

Description

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack.

Related

Alias · CVE (1)

  • CVE-2021-32245 In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References