Description (CNA)
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Bludit / Bludit | affected 4.0.0-beta |
CWE
CWE-79
References
- https://www.bludit.com
- https://github.com/bludit/bludit
- https://github.com/bludit/bludit/blob/dev/bl-kernel/ajax/logo-upload.php
ADP enrichment
No English description supplied.
No references supplied.