CVE-2023-36236: Cross-site Scripting in Bagisto
Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad.
Other sources
Cross Site Scripting vulnerability in webkil Bagisto v1.3.1 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/bagisto/bagistoto a version that resolves this vulnerability.Fixed in 1.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2023-36236?
CVE-2023-36236 is a high severity Cross Site Scripting (XSS) vulnerability that allows arbitrary code execution via crafted SVG file uploads.
How do I fix CVE-2023-36236?
To fix CVE-2023-36236, upgrade your Bagisto installation to version 1.3.2 or later if you are using version 1.3.1 or earlier, or update to version 1.5.1 or newer if you are using 1.5.0.
Which versions of Bagisto are affected by CVE-2023-36236?
CVE-2023-36236 affects Bagisto versions 1.5.0 and earlier, as well as versions 1.3.1 and earlier.
What type of attack does CVE-2023-36236 facilitate?
CVE-2023-36236 facilitates Cross Site Scripting (XSS) attacks, which can lead to the execution of arbitrary code on the victim's browser.
Is there a mitigation measure for CVE-2023-36236?
The primary mitigation for CVE-2023-36236 is to implement strict validation and sanitization of file uploads, particularly SVG files.