MEDIUM🇵🇱 Wersja polska

CVE-2023-46857

CVSS 5.4v3.1pub. 2023-12-07upd. 2024-11-21

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for exploitation.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

  • Squidex.io Squidex

    APP
    Squidex.Io
    < 7.9.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2026-24736CRITICAL9.1PL ✓ten sam produkt

SSRF w Squidex — pełny odczyt odpowiedzi HTTP przez konfigurację Webhooków

CVE-2023-46253CRITICAL9.1ten sam produkt

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitra...

CVE-2023-46252MEDIUM6.8ten sam produkt

Squidex is an open source headless CMS and content management hub. Affected versions are missing origin verifi...

CVE-2023-46744MEDIUM5.4ten sam produkt

Squidex is an open source headless CMS and content management hub. In affected versions a stored Cross-Site Sc...

CVE-2023-3580MEDIUM4.3ten sam produkt

Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.