Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1yd3ItMjk0NS1mcjIy

Cross-site scripting in PageKit

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack.

Permalink: https://github.com/advisories/GHSA-mrwr-2945-fr22
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1yd3ItMjk0NS1mcjIy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 3 years ago
Updated: almost 2 years ago

CVSS Score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-mrwr-2945-fr22, CVE-2021-32245
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-32245
• https://github.com/pagekit/pagekit/issues/963
• https://github.com/advisories/GHSA-mrwr-2945-fr22

Repository: https://github.com/pagekit/pagekit
Blast Radius: 3.3

Affected Packages