high7.5
CVE-2023-48701
Cross-site Scripting via uploaded assets
Impact
### Impact HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. ### Patches It has been patched on 3.4.15 and 4.36.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | statamic/cms | < 3.4.15 | 3.4.15 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Statamic | Statamic | before 3.4.15 from 4.0.0 before 4.36.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/statamic/cms/releases/tag/v3.4.15
- https://github.com/statamic/cms/releases/tag/v4.36.0
- https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv
- https://github.com/advisories/GHSA-8jjh-j3c2-cjcv
- https://nvd.nist.gov/vuln/detail/CVE-2023-48701