Описание
Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the sanitize function. Version 4.10.0 contains a patch for this issue.
Ссылки
- Product
- Product
- Patch
- Patch
- Release Notes
- ExploitVendor Advisory
- Product
- Product
- Patch
- Patch
- Release Notes
- ExploitVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 4.10.0 (исключая)
cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*
EPSS
Процентиль: 46%
0.00236
Низкий
5.5 Medium
CVSS3
5.4 Medium
CVSS3
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 5.5
github
больше 2 лет назад
Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
EPSS
Процентиль: 46%
0.00236
Низкий
5.5 Medium
CVSS3
5.4 Medium
CVSS3
Дефекты
CWE-79