CVE-2023-52085
Winter CMS Local File Inclusion through Server Side Template Injection
Résumé
Winter CMS Local File Inclusion through Server Side Template Injection
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com