PT-2023-21164 · Kiwi Tcms · Kiwi Tcms

Antoniospataro · Published 2023-03-29 · Updated 2023-04-06 · CVE-2023-27489

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.1

Description The issue arises from Kiwi TCMS accepting SVG files uploaded by users, which could contain JavaScript code. If these SVG images are viewed directly, the JavaScript code could execute. This has been fixed by configuring Kiwi TCMS to serve with the Content-Security-Policy HTTP header, which blocks inline JavaScript in all modern browsers.

Recommendations For versions prior to 12.1, upgrade to version 12.1 to resolve the issue. As a temporary workaround for users unable to upgrade, manually set the Content-Security-Policy HTTP header to block inline JavaScript.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-27489

GHSA-2WCR-87WF-CF9J

Affected Products

Kiwi Tcms

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27489.json · Exploit
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j · Vendor Advisory
• https://github.com/kiwitcms/Kiwi/commit/6617cee0fb70cc394b7be6bbc86ef84e6e9de077 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-27489 · Security Note
• https://osv.dev/vulnerability/GHSA-2wcr-87wf-cf9j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27489 · Vendor Advisory
• https://github.com/kiwitcms/Kiwi · Note