CVE-2023-52085
CVE-2023-52085 · Winter CMS Local File Inclusion through Server Side Template Injection
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.
CVSS 3.3 · Baja · EPSS 30,2% · Código de explotación público · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
winter
- Versiones
- < 1.2.4: Afectada
Sin corrección publicada
winter/wn-backend-module Packagist
- Versiones
- v1.0.473
- v1.0.474
- v1.0.475
- v1.1.10
- v1.1.11
- v1.1.2
- v1.1.3
- v1.1.4
- v1.1.5
- v1.1.6
- v1.1.7
- v1.1.8
- v1.1.9
- v1.2.0
- v1.2.1
- v1.2.2
- v1.2.3
- Intervalos de versiones afectados
- ECOSYSTEM: < 1.2.4
Actualiza a 1.2.4