N/A

Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting (XSS) in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. NOTE: this is disputed by the Supplier because "It has been well documented that when serving uploaded files using a method outside of Wagtail (which admittedly is the default), it requires additional configuration from the developer, because Wagtail cannot control how these are served. ... For example, if a Wagtail instance is configured to upload files into AWS S3, Wagtail cannot control the permissions on how they're served, nor any headers used when serving them (a limitation of S3)."

N/A

N/A

Wagtail CMS 安全漏洞

Wagtail CMS是Wagtail开源的一个内容管理系统。 Wagtail CMS 6.4.1版本存在安全漏洞，该漏洞源于文档上传功能导致存储型跨站脚本攻击。

N/A

N/A