CVE-2023-52083: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

December 28, 2023 (updated January 5, 2024)

Winter is a free, open-source content management system. Prior to 1.2.4, users with the media.manage_media permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4.

References

github.com/wintercms/winter/commit/2969daeea8dee64d292dbaa3778ea251e2a7e491
github.com/wintercms/winter/security/advisories/GHSA-4wvw-75qh-fqjp
nvd.nist.gov/vuln/detail/CVE-2023-52083

Code Behaviors & Features

Detect and mitigate CVE-2023-52083 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →