CVE-2023-36236: XSS
First published: Tue Jan 16 2024(Updated: )
Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Webkul Bagisto | <=1.5.0 | |
| composer/bagisto/bagisto | <1.3.2 | 1.3.2 |
| <=1.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bagisto.com/en/
- https://github.com/bagisto/bagisto/pull/4764/commits/7bbf0c4bb565fc2601f031f9bbcdfa06e24dbd45
- https://github.com/Ek-Saini/security/blob/main/XSS_via_fileupload-bagisto
- https://nvd.nist.gov/vuln/detail/CVE-2023-36236
- https://github.com/bagisto/bagisto/commit/7bbf0c4bb565fc2601f031f9bbcdfa06e24dbd45
- https://github.com/advisories/GHSA-c962-g533-823f (Advisory)
Frequently Asked Questions
What is the severity of CVE-2023-36236?
CVE-2023-36236 is a high severity Cross Site Scripting (XSS) vulnerability that allows arbitrary code execution via crafted SVG file uploads.
How do I fix CVE-2023-36236?
To fix CVE-2023-36236, upgrade your Bagisto installation to version 1.3.2 or later if you are using version 1.3.1 or earlier, or update to version 1.5.1 or newer if you are using 1.5.0.
Which versions of Bagisto are affected by CVE-2023-36236?
CVE-2023-36236 affects Bagisto versions 1.5.0 and earlier, as well as versions 1.3.1 and earlier.
What type of attack does CVE-2023-36236 facilitate?
CVE-2023-36236 facilitates Cross Site Scripting (XSS) attacks, which can lead to the execution of arbitrary code on the victim's browser.
Is there a mitigation measure for CVE-2023-36236?
The primary mitigation for CVE-2023-36236 is to implement strict validation and sanitization of file uploads, particularly SVG files.
- collector/mitre-cve
- source/MITRE
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-c962-g533-823f
- alias/CVE-2023-36236
- agent/references
- agent/last-modified-date
- agent/severity
- agent/description
- agent/author
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- collector/github-advisory
- agent/trending
- agent/tags
- agent/source
- vendor/webkul
- canonical/webkul bagisto
- version/webkul bagisto/1.5.0
- package-manager/composer