CVSS: 8.2EPSS: 0%CPEs: 2EXPL: 0CVE-2024-24570 – Statamic account takeover via XSS and password reset link
https://notcve.org/view.php?id=CVE-2024-24570
Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel. Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur. • http://packetstormsecurity.com/files/177133/Statamic-CMS-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2024/Feb/17 https://github.com/statamic/cms/security/advisories/GHSA-vqxq-hvxw-9mv9 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-48701 – Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
https://notcve.org/view.php?id=CVE-2023-48701
Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0. Statamic CMS es un Content Management System (CMS) impulsado por Laravel y Git. • https://github.com/statamic/cms/releases/tag/v3.4.15 https://github.com/statamic/cms/releases/tag/v4.36.0 https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-48217 – Remote code execution via form uploads in statamic/cms
https://notcve.org/view.php?id=CVE-2023-48217
Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. • https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411 https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-47129 – Statamic CMS remote code execution via front-end form uploads
https://notcve.org/view.php?id=CVE-2023-47129
Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0. • https://github.com/Cyber-Wo0dy/CVE-2023-47129 https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75 https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77 https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-36828 – Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
https://notcve.org/view.php?id=CVE-2023-36828
Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue. • https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Http/Controllers/CP/Fieldtypes/FilesFieldtypeController.php#L15 https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Tags/Svg.php#L36-L40 https://github.com/statamic/cms/commit/c714893ad92de6e5ede17b501003441af505b30d https://github.com/statamic/cms/pull/8408 https://github.com/statamic/cms/releases/tag/v4.10.0 https://github.com/statamic/cms/security/advisories/GHSA-6r5g-cq4q-327g • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •