PT-2023-25872 · Unknown · Winter Cms
Abhishekmorla
·
Published
2023-07-07
·
Updated
2024-01-25
·
CVE-2023-37269
CVSS v3.1
2.0
Low
| Vector | AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Winter CMS versions prior to 1.2.3
Description
The issue concerns a stored cross-site scripting (XSS) attack that could be executed by uploading malicious SVG files as the application logo. Users with the
backend.manage branding permission can upload SVGs. To exploit this, an attacker would need developer or super user level permissions and convince the victim to visit the URL of the malicious SVG directly. The application must also use local storage, serving uploaded files under the same domain instead of a CDN, because SVGs are rendered through an img tag, preventing direct payload execution. These factors limit the potential harm.Recommendations
For versions prior to 1.2.3, update to version 1.2.3 to patch the issue through the inclusion of full support for SVG uploads and automatic sanitization of uploaded SVG files.
As a temporary workaround, apply the patches manually from the provided GitHub commits.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Winter Cms