What is GHSA-2wcr-87wf-cf9j?

GHSA-2wcr-87wf-cf9j is a security advisory published by GitHub Security Advisories with High severity. Kiwi TCMS Stored Cross-site Scripting via SVG file

Which CVE IDs does GHSA-2wcr-87wf-cf9j cover?

GHSA-2wcr-87wf-cf9j covers the following CVE IDs: CVE-2023-27489. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2wcr-87wf-cf9j?

GHSA-2wcr-87wf-cf9j has a CVSS v3 base score of 7.6, published by GitHub Security Advisories.

Which products are affected by GHSA-2wcr-87wf-cf9j?

GHSA-2wcr-87wf-cf9j affects 1 product, including: pip/kiwitcms:\u003c 12.1.

GHSA-2wcr-87wf-cf9jHighCVSS 7.6

Kiwi TCMS Stored Cross-site Scripting via SVG file

Vendor

GitHub Security Advisories

Published

March 30, 2023

Last Modified

April 6, 2023

🔗 CVE IDs covered (1)

CVE-2023-27489 →

📋 Description

Impact

Kiwi TCMS accepts SVG files uploaded by users which could potentially contain JavaScript code. If SVG images are viewed directly, i.e. not rendered in an HTML page, this JavaScript code could execute.

Patches

This vulnerability has been fixed by configuring Kiwi TCMS to serve with the Content-Security-Policy HTTP header which blocks inline JavaScript in all modern browsers.

Workarounds

Configure Content-Security-Policy header, see commit 6617cee0.

References

You can visit https://digi.ninja/blog/svg_xss.php for more technical details.

Independently disclosed by Antonio Spataro and @1d8.

🎯 Affected products1

pip/kiwitcms:< 12.1

🔗 References (4)

https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j
https://nvd.nist.gov/vuln/detail/CVE-2023-27489
https://github.com/kiwitcms/Kiwi/commit/6617cee0fb70cc394b7be6bbc86ef84e6e9de077
https://github.com/advisories/GHSA-2wcr-87wf-cf9j