CVE-2023-37611

Packagist/neos/media-browser CVE-2023-37611: medium 5.4, EPSS 0.71%

Neos CMS Cross Site Scripting vulnerability

Action: Upgrade neos/media-browser to 7.3.19 or later.

composer require neos/media-browser:7.3.19

composer require neos/media-browser:8.0.16

composer require neos/media-browser:8.1.11

composer require neos/media-browser:8.2.11

composer require neos/media-browser:8.3.9

Affected

Fixed versions

Sources

• osv: GHSA-6qjf-7g3j-qx25
• https://nvd.nist.gov/vuln/detail/CVE-2023-37611
• https://github.com/neos/neos-development-collection/issues/4833
• https://github.com/neos/neos-development-collection/pull/4812
• https://github.com/neos/neos-development-collection/commit/4ac0df04d2e44e164e95887b466075dde3f04045
• https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
• https://digi.ninja/blog/svg_xss.php
• https://github.com/neos/neos-development-collection
• https://github.com/neos/neos-ui/releases/tag/8.3.4
• https://rodelllemit.medium.com/stored-xss-in-neo-cms-8-3-3-9bd1cb973c5b

CVE-2023-37611 · published 2023-09-19T00:30:13Z · modified 2024-02-16T08:14:28.212711Z · JSON