{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-41048", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-08-22T16:57:23.933Z", "datePublished": "2023-09-21T14:31:07.171Z", "dateUpdated": "2024-08-02T18:46:11.749Z"}, "containers": {"cna": {"title": "plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images", "problemTypes": [{"descriptions": [{"cweId": "CWE-80", "lang": "en", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/plone/plone.namedfile/security/advisories/GHSA-jj7c-jrv4-c65x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/plone/plone.namedfile/security/advisories/GHSA-jj7c-jrv4-c65x"}, {"name": "https://github.com/plone/plone.namedfile/commit/188f66a4577021cf8f2bf7c0f5150f9b9573f167", "tags": ["x_refsource_MISC"], "url": "https://github.com/plone/plone.namedfile/commit/188f66a4577021cf8f2bf7c0f5150f9b9573f167"}, {"name": "https://github.com/plone/plone.namedfile/commit/217d6ce847b7171bf1b73fcb6c08010eb449216a", "tags": ["x_refsource_MISC"], "url": "https://github.com/plone/plone.namedfile/commit/217d6ce847b7171bf1b73fcb6c08010eb449216a"}, {"name": "https://github.com/plone/plone.namedfile/commit/f0f911f2a72b2e5c923dc2ab9179319cc47788f9", "tags": ["x_refsource_MISC"], "url": "https://github.com/plone/plone.namedfile/commit/f0f911f2a72b2e5c923dc2ab9179319cc47788f9"}, {"name": "https://github.com/plone/plone.namedfile/commit/ff5269fb4c79f4eb91dd934561b8824a49a03b60", "tags": ["x_refsource_MISC"], "url": "https://github.com/plone/plone.namedfile/commit/ff5269fb4c79f4eb91dd934561b8824a49a03b60"}, {"name": "https://github.com/plone/Products.PloneHotfix20210518", "tags": ["x_refsource_MISC"], "url": "https://github.com/plone/Products.PloneHotfix20210518"}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/22/2"}], "affected": [{"vendor": "plone", "product": "plone.namedfile", "versions": [{"version": "< 5.6.1", "status": "affected"}, {"version": ">= 6.0.0, < 6.0.3", "status": "affected"}, {"version": ">= 6.1.0, < 6.1.3", "status": "affected"}, {"version": ">= 6.2.0, < 6.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-09-21T14:31:07.171Z"}, "descriptions": [{"lang": "en", "value": "plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in versions 5.6.1 (for Plone 5.2), 6.0.3 (for Plone 6.0.0-6.0.4), 6.1.3 (for Plone 6.0.5-6.0.6), and 6.2.1 (for Plone 6.0.7). There are no known workarounds."}], "source": {"advisory": "GHSA-jj7c-jrv4-c65x", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:46:11.749Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/plone/plone.namedfile/security/advisories/GHSA-jj7c-jrv4-c65x", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/plone/plone.namedfile/security/advisories/GHSA-jj7c-jrv4-c65x"}, {"name": "https://github.com/plone/plone.namedfile/commit/188f66a4577021cf8f2bf7c0f5150f9b9573f167", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/plone/plone.namedfile/commit/188f66a4577021cf8f2bf7c0f5150f9b9573f167"}, {"name": "https://github.com/plone/plone.namedfile/commit/217d6ce847b7171bf1b73fcb6c08010eb449216a", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/plone/plone.namedfile/commit/217d6ce847b7171bf1b73fcb6c08010eb449216a"}, {"name": "https://github.com/plone/plone.namedfile/commit/f0f911f2a72b2e5c923dc2ab9179319cc47788f9", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/plone/plone.namedfile/commit/f0f911f2a72b2e5c923dc2ab9179319cc47788f9"}, {"name": "https://github.com/plone/plone.namedfile/commit/ff5269fb4c79f4eb91dd934561b8824a49a03b60", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/plone/plone.namedfile/commit/ff5269fb4c79f4eb91dd934561b8824a49a03b60"}, {"name": "https://github.com/plone/Products.PloneHotfix20210518", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/plone/Products.PloneHotfix20210518"}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/22/2", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:plone:namedfile:*:*:*:*:*:*:*:*", "matchCriteriaId": "6E9AB900-6A21-4C28-8894-9BAFCB82874F", "versionEndExcluding": "5.6.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:plone:plone:5.2:-:*:*:*:*:*:*", "matchCriteriaId": "A59FAF1B-D7E6-4E0D-894B-3C0FB72AC709", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:plone:namedfile:*:*:*:*:*:*:*:*", "matchCriteriaId": "95C190CC-16E1-445E-B459-729304DADA6C", "versionEndExcluding": "6.0.3", "versionStartIncluding": "6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:plone:plone:*:*:*:*:*:*:*:*", "matchCriteriaId": "8285C132-76EC-49B2-A91B-6EC5669A6CB5", "versionEndIncluding": "6.0.4", "versionStartIncluding": "6.0.0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:plone:namedfile:*:*:*:*:*:*:*:*", "matchCriteriaId": "44357938-13EE-488F-BEB8-B2E3704E94CF", "versionEndExcluding": "6.1.3", "versionStartIncluding": "6.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:plone:plone:6.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "8E612230-2BA8-4AC1-8EA2-D33E008F66AC", "vulnerable": false}, {"criteria": "cpe:2.3:a:plone:plone:6.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "BC97446F-B030-47D8-A7B7-C1D38EAB8BAA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:plone:namedfile:6.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "82190457-CDB2-4347-80CA-6937AA3F42FA", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:plone:plone:6.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "E7C2BC43-9BFB-4147-BDE8-615D4B6C6F32", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in versions 5.6.1 (for Plone 5.2), 6.0.3 (for Plone 6.0.0-6.0.4), 6.1.3 (for Plone 6.0.5-6.0.6), and 6.2.1 (for Plone 6.0.7). There are no known workarounds."}, {"lang": "es", "value": "plone.namedfile permite a los usuarios manejar los campos `File` e `Image` dirigidos, pero no dependiendo del contenido de Plone Dexterity. Antes de las versiones 5.6.1, 6.0.3, 6.1.3 y 6.2.1, existe una vulnerabilidad de Cross-Site Scripting almacenado para im\u00e1genes SVG. Una revisi\u00f3n de seguridad de 2021 ya solucion\u00f3 parcialmente este problema al garantizar que las im\u00e1genes SVG siempre se descarguen en lugar de mostrarse en l\u00ednea. Pero el mismo problema todav\u00eda existe para las escalas de im\u00e1genes SVG. Tenga en cuenta que una etiqueta de imagen con una imagen SVG como fuente no es vulnerable, incluso cuando la imagen SVG contiene c\u00f3digo malicioso. Para explotar la vulnerabilidad, un atacante primero tendr\u00eda que cargar una imagen y luego enga\u00f1ar al usuario para que siga un enlace especialmente manipulado. Los parches est\u00e1n disponibles en las versiones 5.6.1 (para Plone 5.2), 6.0.3 (para Plone 6.0.0-6.0.4), 6.1.3 (para Plone 6.0.5-6.0.6) y 6.2.1 (para Pl\u00f3n 6.0.7). No se conocen workarounds."}], "id": "CVE-2023-41048", "lastModified": "2023-09-26T18:44:34.487", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-09-21T15:15:10.667", "references": [{"source": "security-advisories@github.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/09/22/2"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/plone/Products.PloneHotfix20210518"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/plone/plone.namedfile/commit/188f66a4577021cf8f2bf7c0f5150f9b9573f167"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/plone/plone.namedfile/commit/217d6ce847b7171bf1b73fcb6c08010eb449216a"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/plone/plone.namedfile/commit/f0f911f2a72b2e5c923dc2ab9179319cc47788f9"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/plone/plone.namedfile/commit/ff5269fb4c79f4eb91dd934561b8824a49a03b60"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/plone/plone.namedfile/security/advisories/GHSA-jj7c-jrv4-c65x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}