umbraco/umbraco-cms · Security
Stored XSS via SVG File Upload
- GHSA ID
- GHSA-6xmx-85x3-4cv2
- CVE ID
- CVE-2023-49279
- Severity
- low
- Published
- Updated
- CVSS
- 0 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:N
- CVSS v3
- 0 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:N
Description
Impact
A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.
Workaround
Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation
or
Serve all media from an different host (e.g cdn) that where umbraco is hosted
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')