CVE-2023-42458

Summary

CVE-2023-42458 is a stored cross-site scripting (XSS) vulnerability affecting versions 4.8.10 and 5.8.5 of Zope, an open-source web application server. This issue specifically concerns SVG images, where an attacker could upload a malicious image and then manipulate a user into clicking a crafted link, allowing the attacker's malicious code to be executed within the application. To prevent exploitation, patches are available in Zope 4.8.10 and 5.8.5. As a temporary solution, administrators are advised to restrict the "Add Documents, Images, and Files" permission to trusted roles. This vulnerability does not pose a threat when an SVG image is directly linked using an image tag.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.