CVE-2023-42458
CVSS 3.1 Score 5.4 of 10 (medium)
Details
Summary
CVE-2023-42458 is a stored cross-site scripting (XSS) vulnerability affecting versions 4.8.10 and 5.8.5 of Zope, an open-source web application server. This issue specifically concerns SVG images, where an attacker could upload a malicious image and then manipulate a user into clicking a crafted link, allowing the attacker's malicious code to be executed within the application. To prevent exploitation, patches are available in Zope 4.8.10 and 5.8.5. As a temporary solution, administrators are advised to restrict the "Add Documents, Images, and Files" permission to trusted roles. This vulnerability does not pose a threat when an SVG image is directly linked using an image tag.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Zope
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions