Medium severity · published Dec 7, 2023
CVE-2023-46857
Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature
5.4
CVSS
0.6%
EPSS
No
On KEV
Description
Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for exploitation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Squidex · Squidex.io
before 7.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46857
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46857
Mailing List
http://www.openwall.com/lists/oss-security/2023/11/08/4
Exploit
https://census-labs.com/news/2023/11/08/weak-svg-asset-filtering-mechanism-in-squidex-cms/
Vendor Advisory
https://support.squidex.io/c/news/9
More from Squidex
8.8
CVE-2026-24736
Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration
7.2
CVE-2023-46253
Squidex is an open source headless CMS and content management hub
6.5
CVE-2023-0642
Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0
6.1
CVE-2023-46252
Squidex is an open source headless CMS and content management hub
6.1
CVE-2023-24278
Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability