CVE-2023-36236 — Cross-site Scripting in Bagisto

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
4.8MEDIUMNVD
EPSS
0.2%
top 54.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
BagistoWebkul Bagisto
Timeline
PublishedJan 16
Latest updateJan 17

Description

Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶Packagistbagisto/bagisto< 1.3.2
▶NVDwebkul/bagisto1.5.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
Cross-site Scripting in Bagisto↗2024-01-17
▶
OSV
Cross-site Scripting in Bagisto↗2024-01-17
▶
CVEList
CVE-2023-36236: Cross Site Scripting vulnerability in webkil Bagisto v↗2024-01-16
▶
CVE-2023-36236 — Cross-site Scripting in Bagisto | cvebase