CVE-2023-41048

描述

plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in versions 5.6.1 (for Plone 5.2), 6.0.3 (for Plone 6.0.0-6.0.4), 6.1.3 (for Plone 6.0.5-6.0.6), and 6.2.1 (for Plone 6.0.7). There are no known workarounds.

如何修補 CVE-2023-41048

要修補 CVE-2023-41048,請將受影響套件升級到下列已修補版本。

• —升級至 5.6.1 或更新版本
• —升級至 188f66a4577021cf8f2bf7c0f5150f9b9573f167 或更新版本

CVE-2023-41048 正在被利用嗎?

低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 5.6.1
• from 0, < 188f66a4577021cf8f2bf7c0f5150f9b9573f167, < 217d6ce847b7171bf1b73fcb6c08010eb449216a, < f0f911f2a72b2e5c923dc2ab9179319cc47788f9, < ff5269fb4c79f4eb91dd934561b8824a49a03b60, < 188f66a4577021cf8f2bf7c0f5150f9b9573f167, < 217d6ce847b7171bf1b73fcb6c08010eb449216a, < f0f911f2a72b2e5c923dc2ab9179319cc47788f9, < ff5269fb4c79f4eb91dd934561b8824a49a03b60 | from 0, < 5.6.1, >= 6.0.0, < 6.0.3, >= 6.1.0, < 6.1.3

CVSS 分數

參考連結(11)

• ADVISORYgithub.com/advisories/GHSA-jj7c-jrv4-c65x
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-41048
• PATCHgithub.com/plone/plone.namedfile
• WEBgithub.com/plone/plone.namedfile/commit/188f66a4577021cf8f2bf7c0f5150f9b9573f167