CVE-2023-52084: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

December 28, 2023 (updated December 29, 2023)

Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.

References

github.com/advisories/GHSA-43w4-4j3c-jx29
github.com/wintercms/winter/commit/517f65dfae679b57575b047de13c5af48915a5ba
github.com/wintercms/winter/security/advisories/GHSA-43w4-4j3c-jx29

Code Behaviors & Features

Detect and mitigate CVE-2023-52084 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →