Cross-Site Scripting (XSS)

2023-07-1408:44:33

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

wintercms

winter

storm

vulnerability

svgs

javascript

user input

permissions

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.004

Percentile

73.3%

JSON

wintercms/winter and winter/storm are vulnerable to Cross-Site Scripting (XSS) attacks. The library does not properly escape user input, which allows an attacker with backend.manage_branding permissions to upload SVGs as the application logo and execute malicious javascript on victim’s browser.