References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Known Affected Software Configurations Switch to CPE 2.2

Change History

OR
          *cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:* versions from (including) 6.0.0 up to (excluding) 6.2.3

GitHub, Inc.: https://github.com/statamic/cms/commit/6ed4f65f3387686d6dbd816e9b4f18a8d9736ff6 Types: Patch, Product

GitHub, Inc.: https://github.com/statamic/cms/releases/tag/v6.2.3 Types: Release Notes

GitHub, Inc.: https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8 Types: Vendor Advisory

Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3.

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CWE-79

https://github.com/statamic/cms/commit/6ed4f65f3387686d6dbd816e9b4f18a8d9736ff6

https://github.com/statamic/cms/releases/tag/v6.2.3

https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8