CVE-2023-52085
Low
Description
Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.
SeverityLow
CVSS3.3
Exploit probability—
ProductWinter
PublishedDec 29, 2023
First seenDec 29, 2023
Weakness typeCWE-22Path traversal
How to fix
Update
- wintercms winter1.2.4 or later
- winter/wn-backend-module1.2.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wintercms winter | v < 1.2.4 | 1.2.4 |
| winter/wn-backend-modulePackagist | v < 1.2.4 | 1.2.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.