PT-2023-31917 · Unknown · Winter Cms

Sanineng · Published 2023-12-28 · Updated 2024-01-05 · CVE-2023-52085

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.4

Description The issue concerns a Local File Inclusion vulnerability in Winter CMS, a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. The vulnerability is related to the ColorPicker FormWidget and the compilation of custom stylesheets via LESS.

Recommendations For versions prior to 1.2.4, update to version 1.2.4 to resolve the issue. As a temporary workaround, consider disabling the ColorPicker FormWidget in backend forms until a patch is available. Apply the patch from https://github.com/wintercms/winter/commit/5bc9257fe2bc47d8b786a1b1bf96bafad23d8ddd manually if unable to upgrade to v1.2.4. Restrict access to the Theme Customization form and other forms that include the ColorPicker FormWidget to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-52085

GHSA-2X7R-93WW-CXRQ

Affected Products

Winter Cms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52085.json · Exploit
• https://github.com/wintercms/winter/security/advisories/GHSA-2x7r-93ww-cxrq · Vendor Advisory
• https://github.com/wintercms/winter/commit/5bc9257fe2bc47d8b786a1b1bf96bafad23d8ddd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-52085 · Security Note
• https://osv.dev/vulnerability/GHSA-2x7r-93ww-cxrq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-52085 · Vendor Advisory
• https://github.com/wintercms/winter · Note
• https://twitter.com/VulmonFeeds/status/1740547450132193639 · Twitter Post
• https://twitter.com/RedPacketSec/status/1742486851791798350 · Twitter Post
• https://t.me/cvenotify/66295 · Telegram Post
• https://twitter.com/CVEnew/status/1740536766791143521 · Twitter Post