CVE-2023-36828
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Statamic is a flat-first content management system powered by Laravel and Git. In versions prior to 4.10.0, the SVG tag does not sanitize malicious SVG, allowing attackers to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.
Risk Assessment
Organizations using versions prior to 4.10.0 are vulnerable to XSS attacks, which can lead to data theft or session hijacking.
Recommendation
It is recommended to upgrade to version 4.10.0 or later to secure the system against these attacks.
Original NVD description (English source)
Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.