CVE-2023-48701CWE-79

Statamic CMS vulnerable to Cross-site Scripting via uploaded assets

High · published November 21, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
52.6
In the wild
Unconfirmed
What it is

Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00700 · 52.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-11-21T22:34Z
EPSS history
Timeline
  • 21 NOV 22:34Z
    Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
    cvelistv5