VulnerabilityAnalyzed

CVE-2023-53884

Webedition CMS v2.9.8.8 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript.

MEDIUM 5.1EPSS 0.27%

Does this matter?

Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.

Description

Webedition CMS v2.9.8.8 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG files through the media upload feature to inject and execute arbitrary scripts when the file is viewed by other users.

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.27% probability · 20th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: webedition/webedition cms
Source: disclosure@vulncheck.com

References

https://www.exploit-db.com/exploits/51662Exploit
https://www.vulncheck.com/advisories/webedition-cms-v-stored-cross-site-scripting-via-svg-uploadThird Party Advisory
https://www.webedition.org/Product
https://www.exploit-db.com/exploits/51662Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.