CVE-2023-48701: Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
First published: Tue Nov 21 2023(Updated: )
### Impact HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. ### Patches It has been patched on 3.4.15 and 4.36.0.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/statamic/cms | >=4.0.0<4.36.0 | 4.36.0 |
| composer/statamic/cms | <3.4.15 | 3.4.15 |
| Statamic Statamic | <3.4.15 | |
| Statamic Statamic | >=4.0.0<4.36.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-48701?
CVE-2023-48701 is a vulnerability in the Statamic CMS that allows for cross-site scripting attacks via uploaded assets.
How does the vulnerability in Statamic CMS work?
The vulnerability allows HTML files that are crafted to look like images to be uploaded regardless of mime validation, potentially enabling cross-site scripting attacks.
Which versions of Statamic CMS are affected?
Versions prior to 3.4.15 and 4.36.0 of Statamic CMS are affected.
What is the severity of CVE-2023-48701?
CVE-2023-48701 has a severity value of 7.5, indicating a high severity.
How can I fix the vulnerability in Statamic CMS?
To fix the vulnerability, upgrade to version 3.4.15 or 4.36.0 of Statamic CMS.
- collector/github-advisory-latest
- alias/GHSA-8jjh-j3c2-cjcv
- alias/CVE-2023-48701
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/composer
- vendor/statamic
- canonical/statamic statamic
- version/statamic statamic/4.0.0