CVE-2023-52085

Summary

CVE-2023-52085 is a vulnerability affecting the Winter CMS, an open-source content management system. This issue allows users with access to backend forms, specifically those featuring a ColorPicker FormWidget, to input values that bypass further processing. Consequently, these values can be included directly in the compilation of custom stylesheets via LESS. This vulnerability could potentially result in Local File Inclusion, posing a security risk. The vulnerability has been rectified in version 1.2.4 of Winter CMS.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.