What is GHSA-8jjh-j3c2-cjcv?

GHSA-8jjh-j3c2-cjcv is a security advisory published by GitHub Security Advisories with High severity. Cross-site Scripting via uploaded assets

Which CVE IDs does GHSA-8jjh-j3c2-cjcv cover?

GHSA-8jjh-j3c2-cjcv covers the following CVE IDs: CVE-2023-48701. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8jjh-j3c2-cjcv?

GHSA-8jjh-j3c2-cjcv has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-8jjh-j3c2-cjcv?

GHSA-8jjh-j3c2-cjcv affects 2 products, including: composer/statamic/cms:\u003c 3.4.15; composer/statamic/cms:\u003e= 4.0.0, \u003c 4.36.0.

GHSA-8jjh-j3c2-cjcvHighCVSS 7.5

Cross-site Scripting via uploaded assets

Vendor

GitHub Security Advisories

Published

November 22, 2023

Last Modified

November 22, 2023

🔗 CVE IDs covered (1)

CVE-2023-48701 →

📋 Description

Impact

HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication.

Patches

It has been patched on 3.4.15 and 4.36.0.

🎯 Affected products2

composer/statamic/cms:< 3.4.15
composer/statamic/cms:>= 4.0.0, < 4.36.0

🔗 References (5)

https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv
https://nvd.nist.gov/vuln/detail/CVE-2023-48701
https://github.com/statamic/cms/releases/tag/v3.4.15
https://github.com/statamic/cms/releases/tag/v4.36.0
https://github.com/advisories/GHSA-8jjh-j3c2-cjcv