CVE-2023-36828mediumCWE-79

CVE-2023-36828: falha de média gravidade em statamic cms

Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar cms+ Monitorar statamic/cms

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.5epss 0.7%
Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Produtos afetados
statamic · cms
CVEs relacionadas — statamic cms

No mesmo produto, das mais perigosas para as menos.

CVE-2023-47129HIGHStatamic CMS remote code execution via front-end form uploadsEPSS 1.1%CVE-2023-48217HIGHRemote code execution via form uploads in statamic/cmsEPSS 1.1%CVE-2022-24784LOWDiscoverability of user password hash in Statamic CMSEPSS 1.0%CVE-2024-24570HIGHStatamic account takeover via XSS and password reset linkEPSS 0.7%CVE-2023-48701HIGHStatamic CMS vulnerable to Cross-site Scripting via uploaded assetsEPSS 0.7%CVE-2024-52600MEDIUMStatamic CMS has Path Traversal in Asset UploadEPSS 0.6%