CVE-2023-37269

🗓️ 07 Jul 2023 21:19:38Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 51 Views🌐 WEB

Winter CMS v1.2.3 allows stored XSS via unsanitized SVG uploads. Limited impact due to permissions and serving restrictions

Reporter	Title	Published	Views	Family All 14
0day.today	WinterCMS < 1.2.3 - Persistent Cross-Site Scripting Vulnerability	15 Jul 202300:00	–	zdt
Circl	CVE-2023-37269	8 Jul 202302:17	–	circl
CNNVD	Winter 跨站脚本漏洞	7 Jul 202300:00	–	cnnvd
Cvelist	CVE-2023-37269 Winter CMS vulnerable to stored XSS through privileged upload of SVG file	7 Jul 202321:19	–	cvelist
Exploit DB	WinterCMS < 1.2.3 - Persistent Cross-Site Scripting	15 Jul 202300:00	–	exploitdb
EUVD	EUVD-2023-2167	3 Oct 202520:07	–	euvd
Github Security Blog	Winter CMS stored XSS through privileged upload of SVG file	7 Jul 202321:20	–	github
NVD	CVE-2023-37269	7 Jul 202322:15	–	nvd
OSV	CVE-2023-37269 Winter CMS vulnerable to stored XSS through privileged upload of SVG file	7 Jul 202321:19	–	osv
OSV	GHSA-WJW2-4J7J-6GC3 Winter CMS stored XSS through privileged upload of SVG file	7 Jul 202321:20	–	osv

NVD

Vulners

Node

wintercms winterRange<1.2.3

[
  {
    "vendor": "wintercms",
    "product": "winter",
    "versions": [
      {
        "version": "< 1.2.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/wintercms/winter/commit/fa50b4c7489b67ea80072f8ac9fe5294fce1df1c
github	www.github.com/wintercms/storm/commit/186d85d8fea2cae43afc807d39f68553c24e56be
packetstormsecurity	www.packetstormsecurity.com/files/173520/WinterCMS-1.2.2-Cross-Site-Scripting.html
github	www.github.com/wintercms/winter/releases/tag/v1.2.3
github	www.github.com/wintercms/winter/security/advisories/GHSA-wjw2-4j7j-6gc3

Parameter	Position	Path	Description	CWE
file_data	upload data	/backend/system/settings/update/winter/backend/branding	Stored XSS via unsanitized SVG upload in branding logo prior to patch (CVSS details in document).	CWE-79

21 Nov 2024 08:11Current

4.4Medium risk

Vulners AI Score4.4

CVSS 3.12 - 4.8

EPSS0.01317

CWE-79