CVE-2023-42458 Zope vulnerable to Stored Cross Site Scripting with SVG images

2023-09-2116:34:11

CWE-80

CWE-79

GitHub_M

www.cve.org

zope

cross site scripting

svg

image upload

vulnerability

patches

permissions

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

43.4%

JSON

Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in Zope 4.8.10 and 5.8.5. As a workaround, make sure the “Add Documents, Images, and Files” permission is only assigned to trusted roles. By default, only the Manager has this permission.

CNA Affected

[
  {
    "vendor": "zopefoundation",
    "product": "Zope",
    "versions": [
      {
        "version": "< 4.8.10",
        "status": "affected"
      },
      {
        "version": ">= 5.0.0, < 5.8.5",
        "status": "affected"
      }
    ]
  }
]