Description
Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.
Published: 2023-12-28
Score: 2 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-3092 Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.
Github GHSA Github GHSA GHSA-43w4-4j3c-jx29 Winter CMS Stored XSS through Backend ColorPicker FormWidget
History

Thu, 17 Apr 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Wintercms Winter
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-04-17T20:27:13.689Z

Reserved: 2023-12-26T17:23:22.236Z

Link: CVE-2023-52084

cve-icon Vulnrichment

Updated: 2024-08-02T22:48:12.169Z

cve-icon NVD

Status : Modified

Published: 2023-12-28T23:15:43.777

Modified: 2024-11-21T08:39:08.280

Link: CVE-2023-52084

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses