Skip to content

Cross-site Scripting via uploaded assets

High severity GitHub Reviewed Published Nov 21, 2023 in statamic/cms

Package

composer statamic/cms (Composer)

Affected versions

< 3.4.15
>= 4.0.0, < 4.36.0

Patched versions

3.4.15
4.36.0

Description

Impact

HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication.

Patches

It has been patched on 3.4.15 and 4.36.0.

References

@jasonvarga jasonvarga published to statamic/cms Nov 21, 2023
Published by the National Vulnerability Database Nov 21, 2023
Published to the GitHub Advisory Database Nov 22, 2023
Reviewed Nov 22, 2023

Severity

High
7.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H

Weaknesses

CVE ID

CVE-2023-48701

GHSA ID

GHSA-8jjh-j3c2-cjcv

Source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.