Threat Investigation
Request a demo

CVE-2023-52084

Low

Description

Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.

SeverityLow
CVSS2.0
Exploit probability—
ProductWinter
PublishedDec 28, 2023
First seenDec 28, 2023
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • wintercms winter1.2.4 or later
  • winter/wn-backend-module1.2.4 or later

Affected products

ProductAffected versionsFixed in
wintercms winterv < 1.2.41.2.4
winter/wn-backend-modulePackagistv < 1.2.41.2.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.