GHSA-8jjh-j3c2-cjcv: Cross-site Scripting via uploaded assets

Skip to content

Sign up

CVE-2023-48701

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

Explore

*   All features
*   Documentation
*   GitHub Skills
*   Blog

• For

  • Enterprise
  • Teams
  • Startups
  • Education

  By Solution

  • CI/CD & Automation
  • DevOps
  • DevSecOps

  Resources

  • Learning Pathways
  • White papers, Ebooks, Webinars
  • Customer Stories
  • Partners

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles
    

Repositories

*   Topics
*   Trending
*   Collections

• Pricing

Search code, repositories, users, issues, pull requests…

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches****Use saved searches to filter your results more quickly

Sign in

Sign up

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2023-48701

Cross-site Scripting via uploaded assets

High severity GitHub Reviewed Published Nov 21, 2023 in statamic/cms

Vulnerability details Dependabot alerts 0

Package

composer statamic/cms (Composer)

Affected versions

< 3.4.15

>= 4.0.0, < 4.36.0

Patched versions

3.4.15

4.36.0

Description

Impact

HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the “Forms” feature containing an assets field, or within the control panel which requires authentication.

Patches

It has been patched on 3.4.15 and 4.36.0.

References

• GHSA-8jjh-j3c2-cjcv
• https://nvd.nist.gov/vuln/detail/CVE-2023-48701
• https://github.com/statamic/cms/releases/tag/v3.4.15
• https://github.com/statamic/cms/releases/tag/v4.36.0

jasonvarga published to statamic/cms

Nov 21, 2023

Published by the National Vulnerability Database

Nov 21, 2023

Published to the GitHub Advisory Database

Nov 22, 2023

Reviewed

Nov 22, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

High

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H

Weaknesses

CWE-79

CVE ID

CVE-2023-48701

GHSA ID

GHSA-8jjh-j3c2-cjcv

Source code

statamic/cms

Credits

• Cyber-Wo0dy Reporter

Checking history

See something to contribute? Suggest improvements for this vulnerability.