CVE-2023-36828: Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the sanitize function. Version 4.10.0 contains a patch for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Statamicto a version that resolves this vulnerability.Fixed in 4.10.0
Event History
Frequently Asked Questions
What is CVE-2023-36828?
CVE-2023-36828 is a vulnerability in Statamic, a content management system, that allows attackers to perform cross-site scripting (XSS) attacks using malicious SVG tags.
What is the severity of CVE-2023-36828?
The severity of CVE-2023-36828 is medium, with a severity value of 5.4.
Which versions of Statamic are affected by CVE-2023-36828?
Versions up to 4.10.0 of Statamic are affected by CVE-2023-36828.
How can an attacker exploit CVE-2023-36828?
An attacker can exploit CVE-2023-36828 by using malicious SVG tags to perform cross-site scripting attacks.
Is there a fix for CVE-2023-36828?
Yes, the fix for CVE-2023-36828 is available in versions after 4.10.0 of Statamic.