CVE-2018-18307: Withdrawn Advisory: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field
(updated )
Withdrawn Advisory
This advisory has been withdrawn because it does not describe a vulnerability. The maintainer states the following:
The researcher used an authorized cookie to perform the request to a password-protected route. Without that session cookie, the request would have been rejected as unauthorized.
Original Description
A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field.
References
- github.com/AlchemyCMS/alchemy_cms
- github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/base_controller.rb
- github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/pictures_controller.rb
- github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/resources_controller.rb
- github.com/advisories/GHSA-7mj4-2984-955f
- github.com/rubysec/ruby-advisory-db/blob/master/gems/alchemy_cms/CVE-2018-18307.yml
- nvd.nist.gov/vuln/detail/CVE-2018-18307
- www.exploit-db.com/exploits/45601
Code Behaviors & Features
Detect and mitigate CVE-2018-18307 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →