CVE-2023-52083
Low
Description
Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4.
SeverityLow
CVSS2.0
Exploit probability—
ProductWinter
PublishedDec 28, 2023
First seenDec 28, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- wintercms winter1.2.4 or later
- winter/wn-system-module1.2.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wintercms winter | v < 1.2.4 | 1.2.4 |
| winter/wn-system-modulePackagist | v < 1.2.4 | 1.2.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.